CVE-2026-2874
Published: 21 February 2026
Description
A flaw has been found in Tenda A21 1.0.0.0. Impacted is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. Executing a manipulation of the argument ssid can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The…
more
exploit has been published and may be used.
Mitigating Controls (NIST 800-53 r5)AI
Timely remediation through firmware patching directly eliminates the stack-based buffer overflow in the form_fast_setting_wifi_set function.
Validates the ssid argument to prevent the improper restriction of operations leading to stack-based buffer overflow.
Provides memory protections like stack canaries and ASLR to block exploitation of the stack-based buffer overflow vulnerability.
Security SummaryAI
CVE-2026-2874, published on 2026-02-21, is a stack-based buffer overflow vulnerability in Tenda A21 router firmware version 1.0.0.0. The flaw resides in the function form_fast_setting_wifi_set within the file /goform/fast_setting_wifi_set, where manipulation of the ssid argument triggers the overflow.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWEs 119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and 121 (Stack-based Buffer Overflow). It can be exploited remotely by an attacker possessing low privileges, enabling high-impact consequences on confidentiality, integrity, and availability, such as potential arbitrary code execution.
Advisories and details are documented on VulDB (ctiid.347111, id.347111, submit.754636) and a GitHub repository (QIU-DIE/cve-nneeww/issues/5), where the exploit has been published and may be used. The vendor site is available at https://www.tenda.com.cn/.
The exploit's public availability heightens the risk for unpatched Tenda A21 devices exposed to the network.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in router web interface enables remote arbitrary code execution from low privileges, directly facilitating T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).