CVE-2026-2871
Published: 21 February 2026
Summary
CVE-2026-2871 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda A21 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces validation of argument lists to the fromSetIpMacBind function to prevent stack-based buffer overflows from improper input handling.
Implements memory protections such as stack canaries, non-executable stacks, or ASLR to block arbitrary code execution from stack buffer overflows.
Requires timely flaw remediation through firmware patching to eliminate the buffer overflow vulnerability in Tenda A21 1.0.0.0.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public web management interface (/goform/SetIpMacBind) enables remote exploitation of a network device for initial access (T1190) and allows low-privilege authenticated users to achieve arbitrary code execution and full control (T1068).
NVD Description
A weakness has been identified in Tenda A21 1.0.0.0. This affects the function fromSetIpMacBind of the file /goform/SetIpMacBind. This manipulation of the argument list causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has…
more
been made available to the public and could be used for attacks.
Deeper analysisAI
CVE-2026-2871 is a stack-based buffer overflow vulnerability affecting the Tenda A21 router on firmware version 1.0.0.0. The flaw exists in the fromSetIpMacBind function within the /goform/SetIpMacBind file, where manipulation of the argument list triggers the overflow. It is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
The vulnerability is remotely exploitable over the network with low attack complexity, requiring low privileges (PR:L) and no user interaction, as indicated by its CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). An authenticated attacker with low privileges could exploit it to achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution.
Advisories and additional details are documented in references including VulDB entries (ctiid.347108, id.347108, submit.754630, submit.754631) and a GitHub issue at https://github.com/QIU-DIE/cve-nneeww/issues/2. The exploit has been publicly disclosed and is available for use in attacks, though no specific patch or mitigation steps are outlined in the primary description.
The vulnerability was published on 2026-02-21, with public exploit availability heightening the risk for unpatched Tenda A21 devices.
Details
- CWE(s)