CVE-2026-2870 is a high-severity stack-based buffer overflow vulnerability affecting Tenda A21 1.0.0.0 firmware, specifically within the set_qosMib_list function of the /goform/formSetQosBand file. This flaw allows a remote attacker to achieve arbitrary code execution by manipulating the 'list' argument. With a CVSS score of 8.8, the attack is low complexity and does not require user interaction, leading to high impacts on confidentiality, integrity, and availability. While public exploit code exists, there is currently no evidence of active exploitation, and community discussion and media coverage remain minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0.0.0CPE matchmatch criteria | cpe:2.3:o:tenda:a21_firmware:1.0.0.0:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.