CVE-2021-31755

What it actually does

This vulnerability is a remotely reachable stack-based buffer overflow in the Tenda AC11 router web management interface, specifically the /goform/setmac endpoint in firmware through 02.03.01.104_CN. An unauthenticated network attacker can send a crafted HTTP POST request that overflows a stack buffer, potentially overwriting control-flow data and executing arbitrary code with the privileges of the router web service, which on embedded routers is commonly highly privileged. Successful exploitation can provide full device compromise, including configuration theft, traffic interception, DNS or routing manipulation, malware installation, botnet enrollment, and device disruption. The supplied affected-product/fixed-version metadata referencing hashicorp/vault does not align with the described Tenda AC11 router vulnerability and should not be treated as authoritative remediation information for this CVE.

Why it matters to the business

Compromise of an edge router can expose internal traffic, credentials, network configuration, and connected devices to attacker control. Because the flaw is unauthenticated, network-accessible, has a high CVSS score, high EPSS likelihood, and is listed in CISA KEV with a 2021-11-17 remediation deadline, internet-facing devices should be considered high-priority exposure. Operational consequences may include loss of connectivity, malicious traffic redirection, participation in DDoS or botnet activity, persistent unauthorized access to the network perimeter, and increased incident response cost. Although the KEV record is not flagged as ransomware-associated, edge-device compromise can still support later intrusion activity.

How an attack unfolds

An attacker first identifies a reachable Tenda AC11 administrative web interface, commonly by scanning for exposed router management services. The attacker then sends a specially crafted POST request to /goform/setmac containing oversized or malformed input that the firmware copies into a fixed-size stack buffer without sufficient bounds checking. If the memory corruption is shaped successfully, execution flow is redirected and attacker-controlled code runs on the router. After code execution, the attacker may download additional malware, change DNS or routing settings, dump configuration data, create persistence where possible, proxy traffic through the device, or enroll the router into a botnet. Active exploitation has been reported in the wild, so exposed devices should be investigated as well as patched or replaced.

How to fix it

Upgrade affected Tenda AC11 devices running firmware through 02.03.01.104_CN to a vendor-fixed firmware version if one is available from Tenda for the exact hardware and regional model. If no supported fixed firmware is available, replace the device with a supported model. Do not expose router administration interfaces to the internet; restrict management access to trusted internal administration networks or VPN-only access. Disable remote administration, apply strong administrative credentials, and block unsolicited inbound access to HTTP/HTTPS management ports at upstream firewalls. Rebooting alone is not sufficient because the vulnerability remains exploitable. The provided fixed version entry for hashicorp/vault commit dad2b6048153fea5efbc0c06a5f35c06c767b308 is inconsistent with this Tenda router vulnerability and should not be used as the remediation target for affected routers.

How to confirm the fix worked

Inventory network edge devices and confirm whether any Tenda AC11 units are present. Check the firmware version in the device administration interface or through authenticated configuration export and verify it is newer than 02.03.01.104_CN or otherwise confirmed by the vendor as fixed. From an external perspective, confirm that router administration services are not reachable from the internet and that /goform/setmac is not accessible from untrusted networks. Validate firewall rules, remote management settings, and management-plane segmentation. After remediation, perform a safe authenticated configuration review to confirm no unexpected DNS servers, port forwards, administrative users, startup scripts, or management access settings remain.

Typical attack path

1. Scan public or adjacent networks for Tenda AC11 router web management interfaces.
2. Fingerprint the device and firmware to identify versions through 02.03.01.104_CN.
3. Send an unauthenticated crafted HTTP POST request to /goform/setmac.
4. Trigger a stack buffer overflow in the web management process.
5. Gain arbitrary code execution on the router with the privileges of the vulnerable service.
6. Install malware, alter router configuration, intercept or redirect traffic, or use the device as a foothold/proxy.
7. Attempt persistence, hide artifacts, and continue scanning or attacking other systems from the compromised router.

How to detect it

Check router web access logs, upstream firewall logs, reverse proxy logs if management traffic is proxied, IDS/IPS alerts, NetFlow, DNS logs, and endpoint telemetry from systems communicating with the router. Prioritize evidence of HTTP POST requests to /goform/setmac from untrusted addresses, repeated probing of /goform/ endpoints, oversized request bodies, malformed MAC-address parameters, router web service crashes or restarts, sudden configuration changes, unexpected DNS server changes, new port forwards, enabled remote management, unusual outbound connections from the router, and high-volume scanning or DDoS-like behavior. Because many consumer/SMB routers have limited logging, absence of logs does not prove absence of compromise; use upstream network telemetry and configuration-state review. If compromise is suspected, preserve configuration exports and available logs, disconnect the device from untrusted networks, reset/reflash or replace it, rotate any credentials that traversed or administered the router, and review connected systems for follow-on activity.

• POST /goform/setmac
• /goform/setmac
• GET /goform/setmac
• goform/setmac
• /goform/
• setmac
• mac=
• HTTP request to /goform/setmac with unusually large request body
• HTTP 500 response for /goform/setmac
• web management service crash after request to /goform/setmac
• unexpected DNS server configuration on Tenda AC11
• unexpected port forwarding rule on Tenda AC11
• unexpected remote management enabled on Tenda AC11
• Tenda AC11 firmware 02.03.01.104_CN

What your security team should do

• Immediately identify and isolate any internet-facing Tenda AC11 devices running firmware through 02.03.01.104_CN.
• Patch to vendor-fixed firmware where available; otherwise replace affected devices because this is actively exploited and listed in CISA KEV.
• Disable remote administration and restrict router management access to trusted networks or VPN only.
• Review historical web management access logs, firewall logs, and network telemetry for requests to /goform/setmac, especially HTTP POST requests from untrusted IP addresses.
• Inspect router configurations for unauthorized DNS, routing, port-forwarding, administrative, or remote-management changes.
• Reboot and factory-reset suspected compromised devices before reconfiguration, but only after preserving logs and configuration evidence where feasible.
• Monitor outbound connections from affected network segments for unusual scanning, botnet command-and-control, proxy behavior, or high-volume traffic.
• Treat the supplied HashiCorp Vault fixed-version metadata as a data-quality mismatch and validate remediation against Tenda AC11 firmware advisories instead.