A security vulnerability has been detected in Tenda A21 1

CVE-2026-2872 is a stack-based buffer overflow in Tenda A21 firmware 1.0.0.0, specifically in the set_device_name function behind the /goform/setBlackRule MAC filtering endpoint. The public write-up says a crafted devName parameter can overflow a 256-byte stack buffer via sprintf, potentially crashing the web process or giving an attacker code execution as root on the device.

The vendor's 8.8/HIGH score is technically defensible in a lab, but too generous in a real enterprise queue. The chain already assumes the attacker can reach the device's management plane and has valid credentials (PR:L), and the product itself is an EOL consumer/SOHO range extender with narrow enterprise deployment; that makes this mostly a post-compromise or shadow-IT cleanup problem, not a front-of-queue patch emergency.

Why this verdict

• Vendor baseline starts high, then collapses on friction: 8.8/HIGH assumes the impact once triggered; it does not price in how rarely enterprises expose or even deploy this exact EOL extender.
• Requires authenticated remote access: PR:L means the attacker already has device credentials or equivalent foothold. That is downward pressure because it implies post-initial-access rather than true internet-edge compromise.
• Reachable population is narrow: A21 is a consumer/SOHO range extender, not a mainstream enterprise appliance. In a 10,000-host environment, this is usually a tiny shadow-IT subset, often zero.
• Management-plane locality matters: Tenda's own login guidance describes a built-in local web server reached from a connected device. That implies NGFW policy, admin VLANs, NAC, and simple non-exposure break a lot of real attack paths before the overflow even matters.
• Exploit evidence is weak: there is a public PoC and the CVE record says it 'may be used,' but no KEV entry, no confirmed campaign data in reviewed sources, and the user-supplied EPSS is very low.

Why not higher?

Because this is not unauthenticated mass-exploitation material. The chain needs a reachable admin interface, a real A21 deployment, and valid privileges; each prerequisite narrows the victim pool and compounds the odds that the attacker is already inside. The product category also matters: consumer extender vulnerabilities do not deserve the same queue position as equivalent bugs in widely deployed enterprise edge gear.

Why not lower?

Because if you do have one, the technical consequence is still ugly: stack corruption in an embedded network device can mean root compromise, persistent tampering, or at minimum loss of device management. Public exploit details are available, and unsupported edge-adjacent devices are exactly the sort of forgotten assets that linger unmanaged.

1. Inventory and quarantine A21 devices — Find any Tenda A21 units and move them off production user segments into a restricted management or guest network. For a LOW verdict there is no formal noisgate mitigation SLA, so treat this as backlog hygiene, but do it promptly if the device sits anywhere near sensitive networks because no public fixed firmware was identified.
2. Block access to the admin UI from user networks — Restrict HTTP access to the device management plane so only a small admin subnet can reach it. This breaks the most practical exploitation path and is the right control when the bug requires authenticated use of a local web interface; for LOW, handle as backlog hygiene unless the UI is internet-exposed, in which case accelerate.
3. Rotate device credentials — Change any shared or inherited Tenda admin passwords and remove reused credentials. Since exploitation requires privileges, credential hygiene directly reduces exploitability; for LOW, do it during normal hygiene work, or immediately if you suspect shadow IT or password reuse.
4. Plan replacement, not patch dependence — The A21 support page marks the product EOL and the reviewed vendor materials did not show a newer fixed firmware. Treat any discovered A21 as a replacement candidate rather than something you expect to patch cleanly.

Run this from an auditor workstation that can reach the extender's management IP on the same network segment as the device. Invoke it as python3 check_cve_2026_2872.py http://192.168.0.254 or python3 check_cve_2026_2872.py http://re.tenda.cn; no admin privileges are needed on the workstation, but the script only performs safe fingerprinting and may return UNKNOWN if the UI hides model/version details.

#!/usr/bin/env python3
# Safe fingerprint check for CVE-2026-2872 on Tenda A21
# Exit codes: 0=PATCHED/NOT-AFFECTED, 1=VULNERABLE, 2=UNKNOWN

import re
import sys
import requests
from urllib.parse import urljoin

TIMEOUT = 5
HEADERS = {"User-Agent": "noisgate-cve-check/1.0"}


def fetch(url):
    r = requests.get(url, headers=HEADERS, timeout=TIMEOUT, allow_redirects=True, verify=False)
    return r.status_code, r.text[:200000], r.headers


def normalize_base(base):
    if not base.startswith("http://") and not base.startswith("https://"):
        base = "http://" + base
    return base.rstrip("/")


def main():
    requests.packages.urllib3.disable_warnings()  # type: ignore

    if len(sys.argv) != 2:
        print("UNKNOWN")
        print("Usage: python3 check_cve_2026_2872.py <base_url>")
        sys.exit(2)

    base = normalize_base(sys.argv[1])
    candidates = [
        base,
        urljoin(base + "/", "index.html"),
        urljoin(base + "/", "login.html"),
    ]

    pages = []
    for url in candidates:
        try:
            status, body, headers = fetch(url)
            pages.append((url, status, body, headers))
        except Exception:
            continue

    if not pages:
        print("UNKNOWN")
        print("Could not reach target web UI")
        sys.exit(2)

    blob = "\n".join([p[2] for p in pages])
    headers_blob = "\n".join([str(dict(p[3])) for p in pages])
    combined = (blob + "\n" + headers_blob).lower()

    is_tenda = any(x in combined for x in ["tenda", "tendawifi", "re.tenda.cn"])
    if not is_tenda:
        print("PATCHED")
        print("Target does not fingerprint as a Tenda web UI; likely not affected")
        sys.exit(0)

    model_a21 = any(x in combined for x in ["a21", "ac2100", "range extender"])
    version_1000 = bool(re.search(r"v?1\.0\.0\.0\b", combined))

    # Safe heuristic only: vulnerable if we can identify A21 + vulnerable version.
    if model_a21 and version_1000:
        print("VULNERABLE")
        print("Fingerprinted as Tenda A21 firmware 1.0.0.0, the affected version for CVE-2026-2872")
        sys.exit(1)

    # If we clearly see A21 but no version, we cannot safely claim patched because no public fixed version was identified.
    if model_a21 and not version_1000:
        print("UNKNOWN")
        print("A21 fingerprint detected but firmware version not confirmed; no public fixed version was verified")
        sys.exit(2)

    print("UNKNOWN")
    print("Tenda device detected, but model/version could not be safely confirmed")
    sys.exit(2)


if __name__ == "__main__":
    main()

Sources

1. NVD CVE-2026-2872
2. OpenCVE record for CVE-2026-2872
3. Public GitHub advisory / PoC write-up
4. Tenda A21 support page (EOL, firmware listing)
5. Tenda login guidance for web management page
6. CISA Known Exploited Vulnerabilities Catalog
7. Censys advisory on Tenda exposure context
8. FIRST EPSS overview