PT-2026-27014 · Tenda · Ac21

Junqi · Published 2026-03-22 · Updated 2026-03-23 · CVE-2026-4565

NVD

CVSS v2.0

9.0

High

AV:N/AC:L/Au:S/C:C/I:C/A:C

A vulnerability was detected in Tenda AC21 16.03.08.16. Impacted is the function formSetQosBand of the file /goform/SetNetControlList. Performing a manipulation of the argument list results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

CVE-2026-4565

Affected Products

Ac21

References · 8

• 🔥 https://github.com/hellonestor/killallbug/releases/tag/poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4565 · Security Note
• https://tenda.com.cn · Note
• https://vuldb.com/?ctiid.352402 · Note
• https://vuldb.com/?id.352402 · Note
• https://github.com/hellonestor/killallbug/issues/14 · Note
• https://twitter.com/vuldb/status/2035637155259912656 · Twitter Post
• https://vuldb.com/?submit.775119 · Note