The vulnerability exists in Tenda A21 firmware 1.0.0.0 within the /goform/setBlackRule endpoint used for MAC filtering configuration. Manipulating the devName/mac argument can overflow a stack buffer, potentially allowing an attacker to overwrite return addresses and execute arbitrary code. This is a stack‑based buffer overflow (CWE‑119) and can be escalated to a control‑flow takeover (CWE‑121). According to the CVE description, the exploit can be performed remotely when the device is reachable over the network.

Affected vendor is Tenda, product A21 with firmware version 1.0.0.0. The defect resides in the function set_device_name invoked by the MAC Filtering Configuration Endpoint. The CPE entries confirm the product and firmware version.

The CVSS score of 8.7 indicates a high severity vulnerability, and while the EPSS score is low (<1%), the existence of a publicly disclosed exploit increases the practical risk. The attack vector is remote, meaning an adversary only needs network connectivity to the device. Because the flaw allows code execution, the potential for full device compromise is significant.