Tenda AC11 Router Stack Buffer Overflow Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2021-31755 · Published 07/05/2021 · updated 17/06/2026

Tenda AC11 Router Stack Buffer Overflow Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

In short

CVE-2021-31755 is a CRITICAL (CVSS 9.8) vulnerability.
Exploited in the wild: CISA added it to the KEV catalog on 03/11/2021.
Chance of exploitation in the next 30 days (EPSS): 86.5%, higher than 99.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
AC11 Router Tenda	Versions not published yet (product named by CISA KEV)

Description

An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.

References

Yu3H0/IoT_CVE · Broken Link
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2021-31755

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free