CVE-2026-2886
Published: 21 February 2026
Summary
CVE-2026-2886 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda A21 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-2886 is a stack-based buffer overflow vulnerability in Tenda A21 firmware version 1.0.0.0. The issue affects the set_device_name function in the /goform/SetOnlineDevName endpoint, where improper handling of the devName argument allows overflow. Published on 2026-02-21, it is rated 8.8 on the CVSS 3.1 scale (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
The vulnerability is remotely exploitable over the network with low attack complexity and requires low privileges, such as those of an authenticated user. Successful exploitation can result in high-impact confidentiality, integrity, and availability violations, potentially enabling remote code execution on the affected device.
Advisories referenced in VULDB entries (ctiid.347180, id.347180, submit.754640) and a GitHub issue (QIU-DIE/cve-nneeww/issues/6) detail the vulnerability and confirm a public exploit is available, increasing the risk of attacks. The Tenda vendor website (tenda.com.cn) is listed as a reference, where security practitioners should check for any firmware updates or mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7525
Vulnerability details
A weakness has been identified in Tenda A21 1.0.0.0. This affects the function set_device_name of the file /goform/SetOnlineDevName. This manipulation of the argument devName causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been…
more
made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in web management endpoint (/goform/SetOnlineDevName) allows remote code execution with low privileges (authenticated user), directly enabling exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the stack-based buffer overflow flaw in the set_device_name function via firmware updates directly prevents exploitation of CVE-2026-2886.
Validating the devName argument at the /goform/SetOnlineDevName endpoint ensures inputs do not exceed buffer bounds, directly addressing the improper restriction of operations causing the overflow.
Memory protections such as stack canaries, ASLR, and DEP safeguard against successful exploitation of the stack-based buffer overflow even if invalid inputs are processed.