Description
A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZSetCfg of the file /goform/mDMZSetCfg. The manipulation of the argument dmzIp results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-01-29
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The Tenda AC21 router is vulnerable to command injection through the dmzIp argument of the /goform/mDMZSetCfg endpoint. Supplying a crafted value allows an attacker to execute arbitrary shell commands on the device. This flaw constitutes a remote code execution vulnerability (CWE-74, CWE-77) that undermines the confidentiality, integrity, and availability of the router and any host behind it.

Affected Systems

Affected devices are Tenda AC21 routers running firmware version 16.03.08.16 or earlier, including the embedded configuration server accessed at 1.1.1.1/1.dmzip. The vendor Tenda cites the AC21 series as impacted.

Risk and Exploitability

The CVSS base score of 5.3 reflects a medium severity, and the EPSS score of less than 1% indicates a low exploitation probability as of the current data. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the injection by sending an unauthenticated HTTP request to the exposed internal interface; a publicly available exploit has already been released, so any device with the affected firmware and exposed interface is potentially exploitable.

Generated by OpenCVE AI on April 18, 2026 at 01:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official firmware update released by Tenda that removes the injection point in mDMZSetCfg.
  • Disable or restrict access to the DMZ configuration interface, ensuring that only trusted administrators can reach it, or block the /goform/mDMZSetCfg endpoint via the router firewall.
  • Enforce proper input validation on the dmzIp field or otherwise isolate the router from untrusted hosts by segmenting the network.

Generated by OpenCVE AI on April 18, 2026 at 01:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Mar 2026 17:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:h:tenda:ac21:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:ac21_firmware:16.03.08.16:*:*:*:*:*:*:*

Mon, 23 Feb 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Tenda ac21 Firmware
CPEs cpe:2.3:o:tenda:ac21_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda ac21 Firmware

Fri, 30 Jan 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Jan 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Tenda
Tenda ac21
Vendors & Products Tenda
Tenda ac21

Thu, 29 Jan 2026 23:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZSetCfg of the file /goform/mDMZSetCfg. The manipulation of the argument dmzIp results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Title Tenda AC21 mDMZSetCfg command injection
Weaknesses CWE-74
CWE-77
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Ac21 Ac21 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:08:03.393Z

Reserved: 2026-01-29T16:56:25.779Z

Link: CVE-2026-1638

cve-icon Vulnrichment

Updated: 2026-01-30T18:25:53.616Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-30T00:15:57.563

Modified: 2026-03-09T17:35:02.300

Link: CVE-2026-1638

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T01:15:05Z

Weaknesses