CVE-2026-4565
Published: 23 March 2026
Summary
CVE-2026-4565 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac21 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely remediation of flaws such as this buffer overflow by applying firmware patches or updates to the Tenda AC21 device.
SI-10 mandates validation of inputs to the formSetQosBand function, preventing buffer overflows from manipulated argument lists.
SI-16 implements memory protections like non-executable stacks and ASLR to mitigate arbitrary code execution from buffer overflow exploits.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web form (/goform/SetNetControlList) allows remote authenticated RCE on public-facing management interface.
NVD Description
A vulnerability was detected in Tenda AC21 16.03.08.16. Impacted is the function formSetQosBand of the file /goform/SetNetControlList. Performing a manipulation of the argument list results in buffer overflow. The attack can be initiated remotely. The exploit is now public and…
more
may be used.
Deeper analysisAI
CVE-2026-4565 is a buffer overflow vulnerability in Tenda AC21 firmware version 16.03.08.16. The flaw affects the formSetQosBand function in the /goform/SetNetControlList file, where manipulation of the argument list triggers the overflow. Classified under CWE-119 and CWE-120, it was published on 2026-03-23 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Attackers can exploit this remotely over the network with low attack complexity, requiring low privileges such as an authenticated user account but no user interaction. Successful exploitation yields high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution, data compromise, or denial of service on the affected device.
Advisories and resources are available via VulDB entries and a GitHub repository (hellonestor/killallbug), including an issue tracker and a release tagged with a proof-of-concept exploit.
The exploit is public and may be used, heightening the risk for unpatched Tenda AC21 devices.
Details
- CWE(s)