CVE-2021-31755

Tenda AC11 routers running firmware through 02.03.01.104_CN contain a stack buffer overflow (CWE-787 out-of-bounds write) in the /goform/setmac web endpoint. An unauthenticated attacker can trigger it with a crafted HTTP POST request, overwriting stack memory and executing arbitrary code on the device. Successful exploitation yields full control of the router, enabling traffic interception, lateral movement into the attached home or small-office network, or use in botnets. All AC11 units on affected CN firmware are in scope; no other Tenda products are named in this advisory. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), carries a very high EPSS score of 86.9%, and public proof-of-concept exploit material is available on GitHub.

What to do: Upgrade AC11 firmware to a release newer than 02.03.01.104_CN per Tenda's instructions (no specific fixed version is provided in this data), as required by the CISA KEV catalog. Until patched, disable or restrict WAN-facing HTTP management and monitor for unexpected POST requests to /goform/setmac. Review whether the router is reachable from the internet, since unauthenticated network access is all an attacker needs.