The Tenda A21 router is vulnerable to a remote stack-based buffer overflow that allows authenticated attackers to execute arbitrary code with root privileges.

The vulnerability is a stack-based buffer overflow triggered by the unsafe use of the sprintf function within the set_device_name function. An authenticated attacker can supply a specially crafted, oversized devName parameter to the /goform/SetOnlineDevName endpoint to overwrite the stack frame, enabling remote code execution or a denial of service.

Successful exploitation of this flaw grants an attacker execution capabilities with root privileges, effectively providing full control over the affected router. This could lead to complete network compromise, interception of traffic, and persistence within the local network. Given the high CVSS score of 8.8, this vulnerability poses a critical risk to organizational network integrity and data privacy.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the web management interface to trusted IP addresses only.

Proactive Monitoring: Monitor system logs for repeated crashes or unusual request patterns targeting the /goform/SetOnlineDevName endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block HTTP requests to /goform/SetOnlineDevName that contain unusually long devName parameters.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the linked research write-up on GitHub.

Given the potential for full device compromise and the availability of public proof-of-concept code, this vulnerability represents a significant threat. Administrators must prioritize isolating the management interface from the public internet and monitoring for signs of exploitation until an official firmware update is released by Tenda to resolve the buffer overflow.