CVE-2021-31755: Tenda AC11 router setmac stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityRemote unauthenticated code execution on an internet-facing router, confirmed in CISA KEV with very high EPSS probability.

What it is

Tenda AC11 devices running firmware through 02.03.01.104_CN contain a stack buffer overflow in the /goform/setmac handler. A crafted POST request can overwrite stack memory and lead to arbitrary code execution on the device. The flaw is remotely reachable without authentication, making it a serious risk for internet-exposed routers.

Impact

An attacker can execute arbitrary code on the router with the privileges of the affected service, gaining full control of the device. That enables traffic interception, persistent implanting, or use of the router as a pivot into the local network.

Attack surface

The vulnerability is reached over the network through the /goform/setmac HTTP endpoint. The CVSS vector indicates no privileges and no user interaction are required, so any host that can reach the management interface can attempt exploitation.

Exploitation

CVE-2021-31755 is listed in CISA KEV with a required action deadline of 2021-11-17, and EPSS shows a 30-day probability of 0.869 (99.7th percentile). Public exploit references exist, though the linked GitHub repository is tagged as a broken link.

What to do

• Apply the vendor firmware update for Tenda AC11 devices; if no fixed firmware is available, replace or retire the device.
• Remove the router management interface from the public internet and restrict /goform access to trusted management networks.
• Segment IoT and router management traffic from production and user networks to limit lateral movement after compromise.
• Monitor vendor advisories and CISA KEV for updated guidance, and verify firmware version on all AC11 units.
• Where feasible, disable remote administration and change default administrative credentials.

Detection

• Inspect HTTP logs and packet captures for POST requests to /goform/setmac with unusually long or malformed parameters.
• Alert on router management interface access from unexpected external or non-management source addresses.
• Monitor for unexpected outbound connections, new listening services, or configuration changes on AC11 devices.
• Compare running firmware against the known affected version 02.03.01.104_CN and flag unpatched units.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.