CVE-2021-31755

tenda ac11 firmware

Published 7 May 2021 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, with a remediation deadline of 17 Nov 2021 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.

References

github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_3 · Broken Link, Exploit, Issue Tracking
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31755 · US Government Resource