The Tenda A21 router firmware 1.0.0.0 contains a stack-based buffer overflow in the fromSetIpMacBind function invoked through the /goform/SetIpMacBind endpoint. A malicious actor can send a crafted request to overflow the buffer and overwrite return addresses, leading to arbitrary code execution on the device. This flaw constitutes a remote code execution vulnerability that can compromise confidentiality, integrity, and availability of the router and any devices connected to it. The weakness is typified by CWE‑119 and CWE‑121.

Affected product is the Tenda A21 model running firmware version 1.0.0.0. The vulnerability specifically targets the SetIpMacBind functionality within this firmware.

The flaw receives a CVSS score of 8.7, indicating high severity, while the EPSS score is below 1 %, suggesting limited current exploitation activity but the public availability of exploits means attackers could still target vulnerable devices. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the capability for remote exploitation via a web request makes it a critical risk for administrators who have not applied a patch or disabled the vulnerable feature. A successful exploit would allow an attacker to run arbitrary code on the device, potentially bypassing network controls and accessing connected resources.