CVE-2022-36233
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A buffer overflow vulnerability was discovered in the Tenda AC9 router firmware version V15.03.2.13 in the httpd process. The issue occurs in the form_fast_setting_wifi_set function, potentially allowing remote code execution.
Risk Assessment
An attacker could exploit this vulnerability to take control of the router, compromising the confidentiality and integrity of the local network and potentially attacking other devices.
Recommendation
Immediately update the Tenda AC9 router firmware to the latest available version. If no update is available, restrict management interface access to trusted networks only.
Other vulnerabilities in Tenda AC9
See all- CVE-2026-104611Critical
A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast_setting_internet_set of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.
- CVE-2026-86300High
A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.
- CVE-2025-14286Medium
A vulnerability was determined in Tenda AC9 15.03.05.14_multi. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/DownloadCfg.jpg of the Configuration File Handler component. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2025-9731Low
Tenda AC9 version 15.03.05.19 contains hard-coded credentials in the /etc_ro/shadow file (Administrative Interface component). The attack can be launched locally, is highly complex, and difficult to exploit. The exploit has been publicly disclosed and may be utilized.
- CVE-2021-31627High
A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'index' parameter to execute arbitrary code.
- CVE-2021-31624High
A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'urls' parameter to execute arbitrary code on the device.
Original NVD description (English source)
Tenda AC9 V15.03.2.13 is vulnerable to Buffer Overflow via httpd, form_fast_setting_wifi_set. httpd.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS