CVE-2025-11091
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
A buffer overflow vulnerability has been discovered in Tenda AC21 up to 16.03.08.16, affecting the sscanf function in /goform/SetStaticRouteCfg. Manipulation of the list argument results in buffer overflow. The attack can be launched remotely and the exploit has been released to the public.
Risk Assessment
A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service, potentially taking control of the router. The public availability of the exploit increases the risk of attack.
Recommendation
Update the router firmware to the latest version if the vendor has released a patch, or restrict access to the administrative interface. If no patch is available, consider replacing the device.
Other vulnerabilities in Tenda AC21
See all- CVE-2025-13446High
Tenda AC21 16.03.08.16 has a vulnerability in unknown code of /goform/SetSysTimeCfg. Manipulation of the timeZone/time arguments leads to a stack-based buffer overflow, and the attack can be carried out remotely. The exploit has been publicly disclosed and may be used.
- CVE-2025-12611High
A vulnerability was identified in Tenda AC21 16.03.08.16 affecting the formSetPPTPServer function of the file /goform/SetPptpServerCfg. Manipulation of the startIp argument leads to buffer overflow, and remote exploitation of the attack is possible.
- CVE-2025-10838High
A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function sub_45BB10 of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A security flaw has been discovered in Tenda AC21 up to 16.03.08.16. Affected by this vulnerability is the function sscanf of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS