CVE-2021-31755

Tenda AC11 routers have an unpatched stack buffer overflow allowing remote code execution via a crafted HTTP request.

The Tenda AC11 router's web management interface lacks input validation and memory safety, enabling attackers to execute arbitrary code without authentication. This exposes networks to malware, ransomware, and data theft, directly impacting DIB compliance by violating NIST 800-171 controls for system integrity and access control. Organizations must replace or patch these devices immediately and audit similar Tenda hardware for unpatched CVEs.

Shame score — Tenda shipped routers with a critical, unpatched RCE vulnerability that was actively exploited in the wild, demonstrating severe negligence in supply-chain security and post-market patching.