Tenda · AC11 Router

CVE-2021-31755

Tenda AC11 Router Stack Buffer Overflow Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 87%

What it is

An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.

CISA: Tenda AC11 devices contain a stack buffer overflow vulnerability in /goform/setmac which allows attackers to execute code via a crafted post request.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: November 17, 2021

Added to the CISA list: November 3, 2021
Published: May 7, 2021
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 87% in the top 0.3% of all known vulnerabilities
Weakness: CWE-787
More details: NVD · CVE.org · CISA

All references (1)

https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_3

More exploited flaws from Tenda

Added	Vulnerability	Product	Severity	Attack chance
Nov 3, 2021	Command InjectionCVE-2018-14558	AC7, AC9, and AC10 Routers	Critical 9.8	8.5%
Nov 3, 2021	Remote Code ExecutionCVE-2020-10987	AC1900 Router AC15 Model	Critical 9.8	80%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.