The vulnerability resides in the /cgi-bin/DownloadLog endpoint of the web management interface on the Tenda AC21 router. By manipulating input parameters, an attacker can read sensitive logs sent back in the HTTP response, disclosing configuration and traffic data and compromising confidentiality. This flaw aligns with authorization and information disclosure weaknesses.

Affected products include Tenda AC21 routers running firmware version 16.03.08.16 and prior releases that contain the same web interface component. No other models or firmware revisions are currently identified as vulnerable.

The CVSS base score of 6.9 indicates moderate severity, while the EPSS score of less than 1% signals a very low probability of exploitation in the wild. The flaw is remotely exploitable from any network that can reach the router’s web interface, and the publicly released exploit demonstrates that attackers can use it without additional prerequisites. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation to date.