CVE-2021-31755 Tenda AC11 Router Stack Buffer Overflow

Exploited in the wild Critical 9.8 Published 7 May 2021 Updated 21 Oct 2025

Attackers can execute arbitrary code on Tenda AC11 routers via a stack buffer overflow in the setmac endpoint.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-31755?

CVE-2021-31755 is a critical memory corruption vulnerability in n/a, published on 7 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.

Weakness: CWE-787

Which versions are affected by CVE-2021-31755?

It affects 1 product.

Products include Tenda Ac11 Firmware.

How do I fix CVE-2021-31755?

No fix has been published for CVE-2021-31755 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Nov 2021.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-31755 being exploited?

Yes. Attackers have exploited CVE-2021-31755 in the wild since at least 3 Nov 2021.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-539c-2w6v-9rwx.