Tenda AC21 vulnerabilities

Tenda AC21 16.03.08.16 has a vulnerability in unknown code of /goform/SetSysTimeCfg. Manipulation of the timeZone/time arguments leads to a stack-based buffer overflow, and the attack can be carried out remotely. The exploit has been publicly disclosed and may be used.

A vulnerability was identified in Tenda AC21 16.03.08.16 affecting the formSetPPTPServer function of the file /goform/SetPptpServerCfg. Manipulation of the startIp argument leads to buffer overflow, and remote exploitation of the attack is possible.

A buffer overflow vulnerability has been discovered in Tenda AC21 up to 16.03.08.16, affecting the sscanf function in /goform/SetStaticRouteCfg. Manipulation of the list argument results in buffer overflow. The attack can be launched remotely and the exploit has been released to the public.

A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function sub_45BB10 of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.