A vulnerability has been found in Tenda AC21 16.03.08.16. This vulnerability affects unknown code of the file /goform/SetSysTimeCfg. The manipulation of the argument timeZone/time leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 7.4 · tendaNVD modified 2026-10-18 20:10
Affected (CPE criteria) 1
cpe:2.3:o:tenda:ac21_firmware:16.03.08.16:*:*:*:*:*:*:*
References 9
- https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN8.md Exploit, Third Party Advisory
- https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN9.md Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.333018 Permissions Required, VDB Entry
- https://vuldb.com/?id.333018 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.694425 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.694430 Third Party Advisory, VDB Entry
- https://www.tenda.com.cn/ Product
- https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN8.md Exploit, Third Party Advisory
- https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN9.md Exploit, Third Party Advisory