CVE-2022-36233
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A buffer overflow vulnerability was discovered in the Tenda AC9 router firmware version V15.03.2.13 in the httpd process. The issue occurs in the form_fast_setting_wifi_set function, potentially allowing remote code execution.
Risk Assessment
An attacker could exploit this vulnerability to take control of the router, compromising the confidentiality and integrity of the local network and potentially attacking other devices.
Recommendation
Immediately update the Tenda AC9 router firmware to the latest available version. If no update is available, restrict management interface access to trusted networks only.
Other vulnerabilities in Tenda AC9
See all- CVE-2026-86300High
A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.
- CVE-2021-31627High
A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'index' parameter to execute arbitrary code.
- CVE-2021-31624High
A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'urls' parameter to execute arbitrary code on the device.
Original NVD description (English source)
Tenda AC9 V15.03.2.13 is vulnerable to Buffer Overflow via httpd, form_fast_setting_wifi_set. httpd.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS