CVE-2026-2874
Remote Stack-Based Buffer Overflow in Tenda A21 WiFi Setting
Publication date: 2026-02-21
Last updated on: 2026-02-23
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | a21_firmware | 1.0.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2874 is a critical stack-based buffer overflow vulnerability found in the Tenda A21 router, version 1.0.0.0. The flaw exists in the function form_fast_setting_wifi_set located in the file /goform/fast_setting_wifi_set. It arises from improper handling of the ssid argument, where an attacker can supply an overly long SSID string that is copied into a fixed-size 64-byte stack buffer without proper length validation.
Specifically, the vulnerability is due to the use of the unsafe sprintf function to copy the user-controlled ssid parameter into the buffer, which can overflow the stack when the input exceeds the buffer size. This overflow can overwrite adjacent stack memory, including the saved frame pointer and return address.
The vulnerability can be exploited remotely via HTTP requests to the Wi-Fi configuration endpoint, allowing an attacker to cause a denial of service or potentially execute arbitrary code with root privileges.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability can impact you by allowing a remote attacker to exploit the stack-based buffer overflow in the Tenda A21 router's Wi-Fi configuration function."}, {'type': 'list_item', 'content': "Denial of Service (DoS): The attacker can crash the router's httpd process, causing service disruption."}, {'type': 'list_item', 'content': 'Remote Code Execution (RCE): The attacker can hijack the program counter to execute arbitrary code or a return-oriented programming (ROP) chain with root privileges, potentially taking full control of the device.'}, {'type': 'paragraph', 'content': 'Because the exploit can be launched remotely without authentication or physical access, it poses a high risk to the confidentiality, integrity, and availability of the affected device and network.'}] [1, 2, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring HTTP requests sent to the endpoint /goform/fast_setting_wifi_set on Tenda A21 routers running firmware version 1.0.0.0. Specifically, look for unusually long or crafted SSID parameters in requests to this endpoint, as these are used to trigger the stack-based buffer overflow.'}, {'type': 'paragraph', 'content': 'A practical detection method involves capturing network traffic and filtering for HTTP POST or GET requests targeting /goform/fast_setting_wifi_set with SSID parameters exceeding typical length limits (e.g., longer than 60 characters).'}, {'type': 'paragraph', 'content': 'Example commands to detect suspicious activity include:'}, {'type': 'list_item', 'content': "Using tcpdump to capture HTTP traffic to the vulnerable endpoint: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/goform/fast_setting_wifi_set'"}, {'type': 'list_item', 'content': "Using grep or similar tools on web server logs to find requests with long SSID parameters: grep '/goform/fast_setting_wifi_set' /var/log/httpd/access.log | grep -E 'ssid=.{60,}'"}, {'type': 'paragraph', 'content': 'Additionally, reviewing router logs for crashes or restarts of the httpd process may indicate exploitation attempts.'}] [2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': "Immediate mitigation steps include avoiding exposure of the vulnerable endpoint to untrusted networks and restricting access to the router's management interface."}, {'type': 'paragraph', 'content': 'Since no official patches or mitigations have been documented, it is recommended to replace the affected Tenda A21 router with a non-vulnerable device or firmware version.'}, {'type': 'paragraph', 'content': 'If possible, implement network-level protections such as firewall rules to block HTTP requests to /goform/fast_setting_wifi_set or limit access to trusted IP addresses only.'}, {'type': 'paragraph', 'content': 'Long-term remediation involves updating the firmware to a version where the vulnerable sprintf call is replaced with a safe snprintf call and input validation is enforced on the SSID parameter.'}] [1, 2]