Tenda CVE-2026-4565

Tenda AC21 firmware version 16.03.08.16. Requires authenticated access to the router's web interface. Attacker must send a crafted request to /goform/SetNetControlList with manipulated list arguments to trigger buffer overflow in formSetQosBand function.

This vulnerability presents a significant real-world risk despite requiring low-privilege authentication (PR:L). The CVSS base score of 8.8 reflects the severe potential impact with network-based attack vector (AV:N), low attack complexity (AC:L), and no user interaction required (UI:N). The temporal metrics show proof-of-concept exploit code exists (E:P) with confirmed reproducibility (RC:R), and no official remediation timeline (RL:X). The public availability of working exploit code on GitHub (https://github.com/hellonestor/killallbug/releases/tag/poc) dramatically increases the risk of opportunistic exploitation. While the vulnerability requires authenticated access, many Tenda routers use default credentials or weak passwords, effectively lowering this barrier. The combination of remote exploitability, public exploit code, high impact across confidentiality, integrity, and availability, and the typical permanence of router deployments (infrequent patching) makes this a genuine priority for organizations using affected devices.

An attacker on the local network or with VPN access first authenticates to the Tenda AC21 router's web interface using default credentials, previously compromised credentials, or credentials obtained through social engineering. The attacker then crafts a malicious HTTP request to the /goform/SetNetControlList endpoint with an oversized 'list' parameter value designed to overflow the buffer in the formSetQosBand function. This overflow overwrites the return address on the stack, redirecting execution to attacker-controlled shellcode that establishes persistent backdoor access, modifies DNS settings to redirect traffic, or completely compromises the router to pivot into the internal network. The public proof-of-concept at https://github.com/hellonestor/killallbug/releases/tag/poc provides ready-made exploitation code requiring minimal technical skill to deploy.