Introduction
Remote attackers can gain code execution on Tenda AC21 routers by exploiting a buffer overflow in the static route configuration endpoint. The flaw, tracked as CVE-2025-11091, affects a widely deployed consumer and SMB router platform. Public exploit code is available, so unpatched devices face a higher risk of compromise.
Tenda is a major global provider of networking equipment and is especially popular in cost-sensitive markets. The AC21 is a dual-band wireless router used in homes and small businesses. Tenda's product line is broad, with millions of devices deployed worldwide, so a vulnerability in its firmware can affect a large number of networks.
Technical Information
CVE-2025-11091 is a stack-based buffer overflow in the Tenda AC21 router firmware up to version 16.03.08.16. The flaw is in the firmware's implementation of the /goform/SetStaticRouteCfg endpoint, in the way it uses the sscanf function to parse user-supplied input from HTTP POST requests.
When a remote attacker sends a crafted POST request to /goform/SetStaticRouteCfg with an oversized argument list, sscanf processes the input without adequate bounds checking. The resulting overflow can overwrite critical stack data such as return addresses or function pointers. The router's web server process typically runs with elevated privileges, so a successful exploit can run arbitrary code with high privileges.
The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input). The root cause is insufficient input validation and missing buffer size checks where the firmware uses sscanf to parse configuration parameters.
The referenced sources include no code snippets from the firmware, but the mechanism matches other Tenda router flaws in which unchecked input to a parsing function corrupts the stack. Public exploit code is available, which raises the risk of automated exploitation.
Affected Systems and Versions
- Product: Tenda AC21 router
- Firmware versions: Up to and including 16.03.08.16
- Vulnerable endpoint:
/goform/SetStaticRouteCfg - Vulnerable function:
sscanf(used to process the argument list from the HTTP POST request)
Vendor Security History
Tenda's router firmware has a documented history of buffer overflow vulnerabilities. Notable recent examples include:
- CVE-2025-9605: Stack buffer overflow in
/goform/GetParentControlInfo(mac parameter) - CVE-2025-10838: Buffer overflow in
/goform/WifiExtraSet(wpapsk_crypto argument) - CVE-2025-8160: Buffer overflow in AC20 model
Patch response times have varied, and some vulnerabilities have stayed unpatched for long periods. Tenda's security maturity is considered inconsistent next to industry leaders. The same kind of flaw keeps recurring, which suggests systemic problems with input validation and secure coding practices.
