A vulnerability was detected in Tenda A21 1

CVE-2026-2873 is a buffer overflow in setSchedWifi behind Tenda A21 firmware 1.0.0.0, specifically the /goform/openSchedWifi handler. The reported trigger is oversized schedStartTime or schedEndTime input, and the public write-up shows unsafe strcpy into a small fixed buffer, which means a crash is easy and code execution is plausible on the embedded web process. Authoritative sources only name 1.0.0.0 as affected; I did not find a vendor-published fixed version.

The vendor/NVD-style HIGH baseline overstates the enterprise patch priority. The decisive friction is reachability: this sits on a router/extender management plane that is usually LAN-only, and the published CVSS also assumes PR:L, meaning the exploit path already starts from authenticated access or an already-exposed admin surface. Public PoC keeps this out of LOW, but the combination of low EPSS, no KEV listing, no confirmed in-the-wild use, and typically narrow exposure pushes it down to MEDIUM for a 10,000-host enterprise program.

Why this verdict

• Downgrade for attacker position: the CVSS includes PR:L, so the chain starts from authenticated remote access or an already-reachable admin surface, not from a blind internet worm position.
• Downgrade for exposure population: Tenda A21 is edge/home-office class gear, and its management UI is usually LAN-only; that sharply narrows the fraction of enterprise deployments reachable at step 1.
• Downgrade for threat evidence: no KEV listing, no authoritative in-the-wild reporting, and a very low EPSS mean the vulnerability is not currently behaving like a broad active-campaign priority.
• Keep at MEDIUM, not LOW: there is a public PoC, memory corruption on an edge device can become RCE, and compromise of a router/extender can still enable DNS tampering, traffic interception, or pivoting.

Why not higher?

This is not a clean HIGH in enterprise reality because the chain is choked by two practical gates: management-plane reachability and PR:L. Most organizations will only be exposed if they intentionally expose the admin UI, have weak credential hygiene, or are already dealing with post-initial-access activity on the local network.

Why not lower?

I would not bury this as LOW because memory corruption on network infrastructure is never just a cosmetic bug. The exploit is public, the impact can extend beyond a mere UI crash, and the device sits at a useful pivot point if an attacker does achieve execution.

1. Disable WAN-side administration — If any A21 devices are reachable from the internet, shut that door first; this removes the most dangerous reachability precondition and should be done at the next network change window even though MEDIUM has no formal mitigation SLA.
2. Restrict management to a dedicated admin segment or VPN — Allow HTTP management only from a hardened jump subnet or VPN source range. This collapses the attacker population from 'any internal foothold' to 'only approved admin paths' and should be completed before the remediation window closes.
3. Rotate device credentials and remove defaults — Because the published vector assumes PR:L, credential hygiene directly attacks the exploit chain. Enforce unique passwords for all branch/home-office appliances and complete the cleanup before the remediation window closes.
4. Monitor for device crashes and config drift — The most realistic first-stage impact is management-plane instability or reboot behavior. Alert on unexpected reboots, DNS/NTP changes, admin password changes, and new outbound connections from the device segment before the 365-day remediation deadline.
5. Prepare replacement if no fixed firmware appears — I did not find an authoritative patched version. Track the vendor support page, but if Tenda does not ship a fix, treat replacement or permanent isolation as the remediation path within the MEDIUM remediation window.

Run this on an auditor workstation, CI job, or asset-inventory host — not on the router. Invoke it as python3 check_cve_2026_2873.py --model A21 --version 1.0.0.0 for a single device, or python3 check_cve_2026_2873.py --csv inventory.csv for bulk checks where the CSV has model,version columns. No elevated privileges are required.

#!/usr/bin/env python3
"""
CVE-2026-2873 inventory verifier for Tenda A21.

Purpose:
- Classify assets as VULNERABLE / PATCHED / UNKNOWN using inventory data.
- Current authoritative affected version observed in sources: Tenda A21 firmware 1.0.0.0.
- No authoritative fixed version was found at assessment time.

Exit codes:
  0 = PATCHED / not affected
  1 = VULNERABLE
  2 = UNKNOWN / input error
"""

import argparse
import csv
import sys
from pathlib import Path

AFFECTED_MODELS = {"A21", "TENDA A21"}
AFFECTED_VERSION = "1.0.0.0"


def norm(s: str) -> str:
    return (s or "").strip().upper()


def classify(model: str, version: str) -> str:
    m = norm(model)
    v = (version or "").strip()

    if not m or not v:
        return "UNKNOWN"

    if m not in AFFECTED_MODELS:
        return "PATCHED"

    if v == AFFECTED_VERSION:
        return "VULNERABLE"

    # Only 1.0.0.0 is explicitly listed as affected in the reviewed sources.
    # If you have stronger vendor evidence of a fixed version, replace this logic.
    return "PATCHED"


def single_mode(model: str, version: str) -> int:
    result = classify(model, version)
    print(result)
    return {"PATCHED": 0, "VULNERABLE": 1, "UNKNOWN": 2}[result]


def csv_mode(csv_path: str) -> int:
    path = Path(csv_path)
    if not path.exists():
        print("UNKNOWN")
        print(f"# error: file not found: {csv_path}", file=sys.stderr)
        return 2

    vulnerable = 0
    patched = 0
    unknown = 0

    with path.open(newline="", encoding="utf-8-sig") as fh:
        reader = csv.DictReader(fh)
        required = {"model", "version"}
        if not reader.fieldnames or not required.issubset(set(x.lower() for x in reader.fieldnames)):
            print("UNKNOWN")
            print("# error: CSV must include columns named model and version", file=sys.stderr)
            return 2

        # normalize column lookup
        fieldmap = {name.lower(): name for name in reader.fieldnames}

        for row in reader:
            model = row.get(fieldmap["model"], "")
            version = row.get(fieldmap["version"], "")
            result = classify(model, version)
            print(f"{model},{version},{result}")
            if result == "VULNERABLE":
                vulnerable += 1
            elif result == "PATCHED":
                patched += 1
            else:
                unknown += 1

    print(f"# summary: vulnerable={vulnerable} patched={patched} unknown={unknown}", file=sys.stderr)

    if vulnerable > 0:
        return 1
    if unknown > 0:
        return 2
    return 0


def main() -> int:
    parser = argparse.ArgumentParser(description="Check inventory exposure to CVE-2026-2873")
    parser.add_argument("--model", help="Device model, e.g. A21")
    parser.add_argument("--version", help="Firmware version, e.g. 1.0.0.0")
    parser.add_argument("--csv", help="CSV file with model,version columns")
    args = parser.parse_args()

    if args.csv:
        return csv_mode(args.csv)

    if args.model and args.version:
        return single_mode(args.model, args.version)

    print("UNKNOWN")
    print("# usage: --model A21 --version 1.0.0.0  OR  --csv inventory.csv", file=sys.stderr)
    return 2


if __name__ == "__main__":
    sys.exit(main())

Sources

1. NVD CVE-2026-2873
2. Public PoC / issue thread
3. OSV entry
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS API documentation
6. CVEFind EPSS tracking page
7. OpenCVE Tenda A21 firmware index
8. Tenda A21 support page