CVE-2021-31755
Tenda AC11 Router Stack Buffer Overflow Vulnerability
Description
CVE-2021-31755 is a critical-severity stack buffer overflow vulnerability in Tenda AC11 routers. A stack buffer overflow in the /goform/setmac endpoint allows remote, unauthenticated attackers to execute arbitrary code on the device by sending a specially crafted POST request. The vulnerability affects Tenda AC11 firmware versions through 02.03.01.104_CN. CISA has added CVE-2021-31755 to its Known Exploited Vulnerabilities catalog, and the EPSS score of 94.3% (99.9th percentile) indicates near-certain active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| tenda | ac11 firmware | <= 02.03.01.104_cn |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_3(Broken Link, Exploit, Issue Tracking, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31755(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write occurs when software writes data past the end or before the beginning of an intended buffer. In CVE-2021-31755, the /goform/setmac endpoint in Tenda AC11 firmware does not properly validate the length of input data in a POST request, causing a stack buffer overflow that allows attackers to overwrite adjacent memory and hijack program execution flow.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2021-31755 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting the maximum severity level for this type of vulnerability. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction, making it trivially exploitable by any attacker with network access to the device. Confidentiality (High): Attackers can access sensitive configuration data, stored credentials, and network traffic passing through the router. Integrity (High): Arbitrary code execution allows complete modification of device firmware, routing tables, and network configurations. Availability (High): Exploitation can render the router inoperable or allow attackers to disrupt all network traffic routed through the device. With an EPSS score of 94.3% (99.9th percentile), this vulnerability is among the most likely to be exploited across all known CVEs, making immediate remediation essential.
Exploit Maturity
CVE-2021-31755 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 94.3% (99.9th percentile) places this vulnerability among the most actively exploited in the entire CVE database, indicating near-certain exploitation activity. While no specific public exploit code was found in tagged references, the high EPSS score and KEV listing confirm that working exploits are actively being used by threat actors targeting Tenda router deployments. Federal agencies were required to remediate this vulnerability by 2021-11-17 per CISA’s binding operational directive.
Remediation
- Apply firmware updates immediately as required by CISA KEV: Apply updates per vendor instructions. Update Tenda AC11 devices to the latest available firmware version that addresses the stack buffer overflow in /goform/setmac.
- Restrict management interface access: Ensure the /goform/setmac endpoint and all web management interfaces are not accessible from untrusted networks, especially the internet. Apply firewall rules to limit access to management ports from trusted internal IP addresses only.
- Implement network segmentation: Place Tenda AC11 routers in a segmented network zone with strict ingress and egress filtering to limit the blast radius if a device is compromised.
- Monitor for indicators of compromise: Review device logs and network traffic for unusual activity, including unexpected firmware modifications, unauthorized configuration changes, or anomalous outbound connections from the router.
- Consider device replacement: If no firmware patch is available from the vendor, evaluate replacing the Tenda AC11 with a router from a vendor that provides timely security updates and has a demonstrated patch management process.
Technical Details
CVE-2021-31755 is a stack-based buffer overflow vulnerability in the /goform/setmac handler of Tenda AC11 router firmware through version 02.03.01.104_CN. The vulnerable function does not adequately validate the size of user-supplied input in the POST request body before copying it to a fixed-size stack buffer, resulting in an out-of-bounds write (CWE-787). The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is network-based, requires no privileges or user interaction, and has low complexity. By sending a specially crafted POST request to the /goform/setmac endpoint with an oversized payload, an attacker can overwrite the return address on the stack, redirect execution flow, and achieve arbitrary code execution with the privileges of the web server process, which typically runs as root on embedded devices.
Frequently Asked Questions
Is CVE-2021-31755 being actively exploited?
Yes. CVE-2021-31755 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.3% (99.9th percentile) places it among the most exploited vulnerabilities globally.
What products are affected by CVE-2021-31755?
CVE-2021-31755 affects Tenda AC11 routers running firmware versions up to and including 02.03.01.104_CN. The vulnerability is in the /goform/setmac endpoint of the device’s web management interface.
How do I fix CVE-2021-31755?
Apply the latest firmware update from Tenda for the AC11 router. If no patch is available, restrict access to the device’s web management interface from untrusted networks and implement network segmentation to limit exposure. Consider replacing the device if the vendor does not provide a timely fix.
How severe is CVE-2021-31755?
CVE-2021-31755 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity rating. The vulnerability allows unauthenticated remote code execution with no user interaction required, making it an extremely dangerous flaw that requires immediate attention.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.