Grade F · High Risk

Is Tenda Router Safe?

Tenda is a Chinese-owned router brand with new models blocked from FCC authorization. F grade. No active US security support. Full analysis.

Security Verdict

Tenda is owned by Shenzhen Tenda Technology Co., Ltd., a Chinese company. New Tenda router models are blocked from FCC authorization as of 2026. Tenda has minimal security team presence in the US, a history of serious CVEs (CVE-2020-10987 and CVE-2020-10988, both CVSS 9.8), and no proactive vulnerability disclosure program. Like all Chinese-owned networking equipment, Tenda is subject to China's National Intelligence Law. Tenda routers should be replaced.

Bottom line: Replace. Chinese-owned, no US security support, critical CVEs, new models blocked from FCC authorization.

Corporate Ownership Structure

Shenzhen Tenda Technology Co., Ltd. is a privately held Chinese company incorporated in Shenzhen (registration number: 91440300753827732B). Tenda has not publicly disclosed its ownership structure. Founded in 1999, the company operates entirely within China's regulatory jurisdiction - including the National Intelligence Law, which requires cooperation with state intelligence requests.

Tenda Models - Security Grades

All Tenda models in our database. Click a model for its full security report.

Model	Grade	FCC Status	Security Support	Made In
AC23	F	Authorized	No active US security team	China
AC19	F	Authorized	Minimal	China

Key Risk Factors

Chinese ownership and state law exposure

Tenda is a Chinese company subject to China's National Intelligence Law.

Critical CVEs, no proactive patching

CVE-2020-10987 and CVE-2020-10988 (both CVSS 9.8) exposed Tenda routers to remote code execution. Tenda has no proactive vulnerability disclosure program.

New models blocked from FCC authorization

As of 2026, new Tenda models cannot receive FCC authorization in the United States.

Known CVEs - Tenda Routers

The following vulnerabilities from the NIST National Vulnerability Database affect Tenda router models. This is a representative sample; the full CVE list may be longer.

CVE-2022-35543 Critical (CVSS 9.8)

Stack-based buffer overflow in AX1806 via the cookie parameter in the setSchedWifi function. Unauthenticated remote code execution - no login required to exploit. An attacker on the internet can take full control.

CVE-2022-40849 High (CVSS 7.5)

Arbitrary file read via absolute path traversal on AC1200 models. Exposes configuration files including credentials to unauthenticated remote attackers.