ax1806 firmware vulnerabilities and fixes

Recent CVEs affecting ax1806 firmware, with upgrade or downgrade steps. 35 tracked.

Also searched as: ax1806firmware.

ax1806 firmware has 35 tracked vulnerabilities, 16 critical. A fixed release or vendor patch exists for 0. Most recent: 2026-01-21. Highest priority: CVE-2024-44555 (score 58/100).

• CVE-2025-71021 HIGH 7.5 MITIGATE Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serverName parameter of the sub_65A28
• CVE-2025-71020 HIGH 7.5 MITIGATE Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_4C408 f
• CVE-2025-71019 HIGH 7.5 MITIGATE Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the wanSpeed parameter of the sub_65B5C f
• CVE-2025-70753 HIGH 7.5 MITIGATE Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_4CA5
• CVE-2025-70747 HIGH 7.5 MITIGATE Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serviceName parameter of the sub_65A2
• CVE-2025-70746 HIGH 7.5 MITIGATE Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysT
• CVE-2025-70744 HIGH 7.5 MITIGATE Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the cloneType parameter of the sub_65B5C
• CVE-2025-70656 HIGH 7.5 MITIGATE Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the mac parameter of the sub_65B5C functi
• CVE-2025-70650 HIGH 7.5 MITIGATE Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetMa
• CVE-2025-70645 HIGH 7.5 MITIGATE Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetWi
• CVE-2025-70644 HIGH 7.5 MITIGATE Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the time parameter of the sub_60CFC funct
• CVE-2024-4239 HIGH 8.8 MITIGATE A vulnerability was found in Tenda AX1806 1.0.0.1 and classified as critical
• CVE-2024-4238 HIGH 8.8 MITIGATE A vulnerability has been found in Tenda AX1806 1.0.0.1 and classified as critical
• CVE-2024-4237 HIGH 8.8 MITIGATE A vulnerability, which was classified as critical, was found in Tenda AX1806 1.0.0.1
• CVE-2024-44565 CRITICAL 9.8 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the serverName parameter in the function form_fast_setting
• CVE-2024-44563 CRITICAL 9.8 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function setIptvInfo.
• CVE-2024-44558 CRITICAL 9.8 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function setIptvInfo
• CVE-2024-44557 CRITICAL 9.8 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo.
• CVE-2024-44556 CRITICAL 9.8 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function setIptv
• CVE-2024-44555 CRITICAL 9.8 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo.
• CVE-2024-44553 CRITICAL 9.8 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formGetIptv.
• CVE-2024-44552 CRITICAL 9.8 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formGet
• CVE-2024-44551 CRITICAL 9.8 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv.
• CVE-2024-44550 CRITICAL 9.8 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formGetIptv
• CVE-2024-44549 CRITICAL 9.8 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv.
• CVE-2024-41492 HIGH 7.5 MITIGATE A stack overflow in Tenda AX1806 v1.0.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted in
• CVE-2024-40417 MEDIUM 6.5 MITIGATE A vulnerability was found in Tenda AX1806 1.0.0.1
• CVE-2024-40416 CRITICAL 9.8 MITIGATE A vulnerability in /goform/SetVirtualServerCfg in the sub_6320C function in Tenda AX1806 1.0.0.1 firmware lead
• CVE-2024-40415 CRITICAL 9.8 MITIGATE A vulnerability in /goform/SetStaticRouteCfg in the sub_519F4 function in Tenda AX1806 1.0.0.1 firmware leads
• CVE-2024-40414 CRITICAL 9.8 MITIGATE A vulnerability in /goform/SetNetControlList in the sub_656BC function in Tenda AX1806 1.0.0.1 firmware leads
• CVE-2024-35580 CRITICAL 9.8 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formSetIptv
• CVE-2024-35579 HIGH 7.7 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formSetIptv.
• CVE-2024-35578 HIGH 8.0 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formSet
• CVE-2024-35576 MEDIUM 5.2 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formSetIptv.
• CVE-2024-35571 CRITICAL 9.8 MITIGATE Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv.

FAQ

How do I fix ax1806 firmware vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is ax1806 firmware being exploited right now?

None of the tracked ax1806 firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which ax1806 firmware CVE should I patch first?

CVE-2024-44555 currently ranks highest (58/100): Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo..

RSS feed for ax1806 firmware · ← Back to latest CVEs