Critical · published August 29, 2025
🚨 A remote attacker can trigger a stack-based buffer overflow in Tenda AC21 and AC23 routers with just a manipulated MAC address! 🔥 Think of this vulnerability like a delivery driver who accidentally delivers a package intended for a neighbor to your front door instead—once they enter, they can leave anything inside your home. Here, the process mishandles data input, allowing attackers to overflow the stack and execute their own code. This could lead to an attacker gaining unauthorized access to your router, allowing them to modify settings, intercept traffic, or even launch further attacks on your network—absolutely devastating for your security! Imagine them taking over your digital home and redecorating it to their liking!
Think of this vulnerability like a delivery driver who accidentally delivers a package intended for a neighbor to your front door instead—once they enter, they can leave anything inside your home. Here, the process mishandles data input, allowing attackers to overflow the stack and execute their own code. The vulnerability resides in the function GetParentControlInfo within the router's firmware, where improper handling of the MAC address argument can cause a buffer overflow, giving attackers control over execution flow.
This could lead to an attacker gaining unauthorized access to your router, allowing them to modify settings, intercept traffic, or even launch further attacks on your network—absolutely devastating for your security! Imagine them taking over your digital home and redecorating it to their liking! Immediately patch your Tenda AC21 and AC23 routers to version 16.03.08.17 or later. Additionally, consider disabling remote management features if not needed and changing default credentials to something strong and unique. 🛡️ You’ve got this! Stay vigilant and keep your network safe from intruders! ⚡
| Product | Versions | Fixed in |
|---|---|---|
| tenda/ac21_firmware | all versions | — |
| tenda/ac23_firmware | all versions | — |