A stack-based buffer overflow occurs in the set_qosMib_list function of the /goform/formSetQosBand endpoint on the Tenda A21 Router (firmware 1.0.0.0). The flaw is triggered by manipulating the argument list supplied to this function, allowing an attacker to overflow a stack buffer and potentially execute arbitrary code. The vulnerability is exploitable over the network and has a publicly available exploit, making it a severe risk for any exposed device.

The Tenda A21 router running firmware version 1.0.0.0 is affected. No other Tenda models or firmware versions are listed in the current data.

The vulnerability carries a CVSS score of 8.7, indicating high severity. The EPSS score is less than 1%, suggesting low current exploitation probability, but the existence of a public exploit and the remote attack vector increase the potential threat. The flaw is not listed in the CISA KEV catalog, yet the combination of high impact and a remote trigger warrants prompt action.