A stack‑based buffer overflow exists in Tenda A21 routers’ firmware 1.0.0.0, specifically within the form_fast_setting_wifi_set function of the /goform/fast_setting_wifi_set endpoint. A crafted ssid parameter that exceeds the expected input size can trigger the overflow, potentially allowing an attacker to inject and execute arbitrary code on the device. This flaw is classified as a classic buffer overflow (CWE‑119) and stack corruption (CWE‑121).

All Tenda A21 routers running firmware version 1.0.0.0 are affected. The vulnerability is only reported for this version, and no other firmware releases or product variants are listed. The flaw resides in the web‑based configuration interface, making remote access a vector for exploitation.

The flaw carries a CVSS score of 8.7, indicating high severity, but the EPSS score is less than 1 %, showing that widespread exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. An attacker only needs to send a maliciously crafted POST request to the /goform/fast_setting_wifi_set endpoint from a remote location; based on the description of remote exploitation via the web interface, it is inferred that the vulnerable endpoint does not require authentication, making the attack remotely accessible. Published proof‑of‑concept code demonstrates that an exploit can be triggered remotely, implying that the risk remains significant for exposed devices.