The documented flaw is a buffer overflow in the formSetQosBand handler within the /goform/SetNetControlList interface of the Tenda AC21. By supplying an overly long or carefully structured argument list, an attacker can corrupt the stack on the device, potentially allowing arbitrary memory write and execution of malicious code. Because the handler can be invoked remotely, the attacker does not need prior authentication; the vulnerability is exploitable over the public network and is known to be actively used.

The flaw affects all Tenda AC21 routers running firmware version 16.03.08.16, as identified in the product’s CPE entries. No older versions are explicitly listed, but the same implementation of formSetQosBand likely exists in firmware builds released around that time. Administrators should verify their device’s current firmware version against the vendor’s catalog to determine exposure.

The advisory assigns a CVSS score of 8.7, indicating high severity, while the EPSS score is below 1 %, suggesting a low average likelihood of detection but not ruling out opportunistic exploitation. The vulnerability is not yet included in CISA’s KEV catalog, meaning active exploitation in the wild is not formally documented, yet proof‑of‑concept exploits are publicly available, underscoring the need for timely mitigation.