CVE-2026-2872 Details
Description
A security vulnerability has been detected in Tenda A21 1.0.0.0. This vulnerability affects the function set_device_name of the file /goform/setBlackRule of the component MAC Filtering Configuration Endpoint. Such manipulation of the argument devName/mac leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
A stack-based buffer overflow vulnerability has been identified in the Tenda A21 router, specifically in the firmware version 1.0.0.0. The issue arises within the MAC filtering configuration endpoint '/goform/setBlackRule', in the 'set_device_name' function. This vulnerability allows remote attackers to manipulate the 'devName' and 'mac' parameters, leading to stack corruption and potential control over the instruction pointer. The vulnerability is caused by unsafe string handling with the 'sprintf' function, which lacks proper input validation, allowing excessively long 'devName' values to overflow a fixed-size stack buffer.
To address this vulnerability, it is recommended to replace the 'sprintf' function with 'snprintf' to ensure proper bounds checking. Additionally, input validation should be implemented to restrict the length of the 'devName' parameter. Tenda users are advised to check the official Tenda website or contact Tenda support for guidance on updating their devices.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/QIU-DIE/cve-nneeww/issues/3 | [email protected] | ExploitIssue TrackingMitigationThird Party Advisory |
| https://vuldb.com/?ctiid.347109 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.347109 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.754634 | [email protected] | Third Party AdvisoryVDB Entry |
| https://www.tenda.com.cn/ | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tenda a21 firmware | 1.0.0.0 |
CPE
Remediation
| |
| tenda a21 | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 23, 2026 | Initial Analysis | [email protected] |
| Feb 21, 2026 | New CVE Received | [email protected] |