PatchTheCVE: ax12 firmwarehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-29215: Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_43fdcc function at /goform/Shttps://patchthecve.com/cve/CVE-2025-29215.htmlhttps://patchthecve.com/cve/CVE-2025-29215.htmlWed, 17 Jun 2026 09:05:12 +0000MEDIUM 6.5: Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_43fdcc function at /goform/SetNetControlList.CVE-2025-29214: Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_42F69C function at /goform/shttps://patchthecve.com/cve/CVE-2025-29214.htmlhttps://patchthecve.com/cve/CVE-2025-29214.htmlWed, 17 Jun 2026 09:05:12 +0000HIGH 7.5: Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_42F69C function at /goform/setMacFilterCfg.CVE-2024-39963: AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0https://patchthecve.com/cve/CVE-2024-39963.htmlhttps://patchthecve.com/cve/CVE-2024-39963.htmlWed, 17 Jun 2026 07:43:05 +0000HIGH 8.0: AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered to contain an authenticated remote command execution (RCE) vulnerability via the macFilterType parameter at /goform/setMacFilterCfg.CVE-2024-40503: An issue in Tenda AX12 v.16.03.49.18_cn+ allows a remote attacker to cause a denial of service via the Routinghttps://patchthecve.com/cve/CVE-2024-40503.htmlhttps://patchthecve.com/cve/CVE-2024-40503.htmlWed, 17 Jun 2026 07:45:59 +0000MEDIUM 6.5: An issue in Tenda AX12 v.16.03.49.18_cn+ allows a remote attacker to cause a denial of service via the Routing functionality and ICMP packet handling.CVE-2024-40412: Tenda AX12 v1.0 v22.03.01.46 contains a stack overflow in the deviceList parameter of the sub_42E410 function.https://patchthecve.com/cve/CVE-2024-40412.htmlhttps://patchthecve.com/cve/CVE-2024-40412.htmlWed, 17 Jun 2026 07:45:50 +0000MEDIUM 6.8: Tenda AX12 v1.0 v22.03.01.46 contains a stack overflow in the deviceList parameter of the sub_42E410 function.CVE-2024-28383: Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub_431Chttps://patchthecve.com/cve/CVE-2024-28383.htmlhttps://patchthecve.com/cve/CVE-2024-28383.htmlWed, 17 Jun 2026 07:21:22 +0000CRITICAL 9.8: Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub_431CF0 function.CVE-2023-47422: An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 https://patchthecve.com/cve/CVE-2023-47422.htmlhttps://patchthecve.com/cve/CVE-2023-47422.htmlWed, 17 Jun 2026 06:32:42 +0000HIGH 8.8: An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via a crafted URL.CVE-2023-49427: Buffer Overflow vulnerability in Tenda AX12 V22.03.01.46, allows remote attackers to cause a denial of servicehttps://patchthecve.com/cve/CVE-2023-49427.htmlhttps://patchthecve.com/cve/CVE-2023-49427.htmlWed, 17 Jun 2026 06:35:58 +0000HIGH 7.5: Buffer Overflow vulnerability in Tenda AX12 V22.03.01.46, allows remote attackers to cause a denial of service (DoS) via list parameter in SetNetControlList function.CVE-2023-49437: Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' paramethttps://patchthecve.com/cve/CVE-2023-49437.htmlhttps://patchthecve.com/cve/CVE-2023-49437.htmlWed, 17 Jun 2026 06:35:59 +0000CRITICAL 9.8: Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.CVE-2023-49428: Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parametehttps://patchthecve.com/cve/CVE-2023-49428.htmlhttps://patchthecve.com/cve/CVE-2023-49428.htmlWed, 17 Jun 2026 06:35:58 +0000CRITICAL 9.8: Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.CVE-2023-49426: Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetStatichttps://patchthecve.com/cve/CVE-2023-49426.htmlhttps://patchthecve.com/cve/CVE-2023-49426.htmlWed, 17 Jun 2026 06:35:57 +0000CRITICAL 9.8: Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg.CVE-2023-49425: Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/sethttps://patchthecve.com/cve/CVE-2023-49425.htmlhttps://patchthecve.com/cve/CVE-2023-49425.htmlWed, 17 Jun 2026 06:35:57 +0000CRITICAL 9.8: Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg .CVE-2023-49424: Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtuahttps://patchthecve.com/cve/CVE-2023-49424.htmlhttps://patchthecve.com/cve/CVE-2023-49424.htmlWed, 17 Jun 2026 06:35:57 +0000CRITICAL 9.8: Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.