CVE-2026-1638

published 2026-01-30

CVE-2026-1638: A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZSetCfg of the file /goform/mDMZSetCfg…

low 2.1 CVSS 4.0

AV N AC L AT N PR L UI N VC L VI L VA L SC N SI N SA N E P CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZSetCfg of the file /goform/mDMZSetCfg. The manipulation of the argument dmzIp results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
linux	linux_kernel	>= 3.13.0 < 6.1.167	6.1.167
linux	linux_kernel	>= 6.13.0 < 6.18.17	6.18.17
linux	linux_kernel	>= 6.19.0 < 6.19.7	6.19.7
linux	linux_kernel	>= 6.2.0 < 6.6.130	6.6.130
linux	linux_kernel	>= 6.7.0 < 6.12.77	6.12.77
tenda	ac21	—	—
tenda	ac21	—	—
tenda	ac21	—	—
tenda	ac21_firmware	—	—

CWE-74 CWE-77 CWE-476