CVE-2026-1638

CWE-74CWE-77 — Command InjectionCWE-476 — NULL Pointer Dereference6 documents6 sources
Severity
5.3MEDIUM
EPSS
0.1%
top 66.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Tenda Ac21Tenda Ac21 Firmware
Timeline
PublishedJan 30
Latest updateMar 25

Description

A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZSetCfg of the file /goform/mDMZSetCfg. The manipulation of the argument dmzIp results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5tenda/ac211.1.1.1, 1.dmzip, 16.03.08.16+2
▶NVDtenda/ac21_firmware16.03.08.16

🔴Vulnerability Details

3
OSV
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()↗2026-03-25
▶
GHSA
GHSA-2wx5-jfx2-287m: A security flaw has been discovered in Tenda AC21 1↗2026-01-30
▶
CVEList
Tenda AC21 mDMZSetCfg command injection↗2026-01-29
▶

📋Vendor Advisories

1
Red Hat
kernel: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()↗2026-03-25
▶