What is the CVSS score of CVE-2026-1637?

CVE-2026-1637 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ac21 Firmware are affected by CVE-2026-1637?

Tenda AC21 routers (model 16.03.08.16) contain a high-severity remote code execution vulnerability that allows unauthenticated attackers to compromise network infrastructure.

How to fix or mitigate CVE-2026-1637?

Within 24 hours: Inventory all Tenda AC21 devices in production and isolate affected units from critical network segments. Within 7 days: Implement network segmentation to restrict direct internet access to vulnerable devices and deploy WAF rules blocking requests to /goform/AdvSetMacMtuWan endpoint. Within 30 days: Develop replacement strategy with alternate vendor hardware and plan migration timeline, as no patch availability suggests end-of-life product status.

Ac21 Firmware CVE-2026-1637

HIGH

Buffer Overflow (CWE-119)

2026-01-29 cna@vuldb.com

Buffer Overflow Stack Overflow Tenda Ac21 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

CVE Published

Jan 29, 2026 - 23:16 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function fromAdvSetMacMtuWan of the file /goform/AdvSetMacMtuWan. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

AnalysisAI

Tenda AC21 firmware versions up to 16.03.08.16 contain a stack-based buffer overflow in the /goform/AdvSetMacMtuWan endpoint that can be exploited remotely by authenticated attackers to achieve arbitrary code execution. Public exploit code exists for this vulnerability, and no patch is currently available. The high CVSS score (8.8) reflects the severity of this flaw affecting device confidentiality, integrity, and availability.

Technical ContextAI

Classified as CWE-119 (Buffer Overflow). Affects Ac21 Firmware. A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function fromAdvSetMacMtuWan of the file /goform/AdvSetMacMtuWan. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

RemediationAI

Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.