A critical remote buffer overflow vulnerability in Tenda AC21 routers allows attackers to execute arbitrary code or cause a denial of service.

This is a stack-based buffer overflow caused by improper bounds checking within the sub_45BB10 function when processing the wpapsk_crypto parameter. An attacker with low privileges can trigger this condition by sending a crafted HTTP request to the /goform/WifiExtraSet endpoint.

Successful exploitation of this vulnerability could lead to a complete compromise of the affected router, resulting in unauthorized network access, interception of traffic, or persistent denial of service. Given the CVSS score of 8.8, this flaw represents a significant risk to organizational infrastructure, particularly for remote or branch office deployments where this hardware is commonly utilized.

Immediate Action: Update the Tenda AC21 firmware to the latest available version provided by the manufacturer. If an update is not yet available, restrict access to the web management interface to trusted internal networks only.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests directed toward the /goform/WifiExtraSet endpoint. Review system logs for signs of service crashes or unexpected reboots.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block HTTP requests containing overly long strings in the wpapsk_crypto parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up linked in the CVE record.

The severity of this vulnerability, combined with the availability of functional exploit code, necessitates immediate action. Administrators must prioritize updating affected Tenda AC21 devices to the latest firmware version to eliminate the underlying memory corruption flaw. If immediate patching is not feasible, network segmentation and strict access controls on the management interface are required to prevent external exploitation.