LiveActive security incident?Get immediate response
CVE Record

CVE-2021-31757: An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN.

An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This CVE affects Tenda AC11 routers running firmware through 02.03.01.104_CN. A flaw in VLAN-setting handling may let an attacker take control of the device. For executives, the main concern is compromise of an edge network device, but the public bundle does not confirm active exploitation or a vendor fix.

Executive priority

Prioritize if Tenda AC11 devices are deployed, especially at network edges or remotely managed locations. Treat as potentially serious because router code execution can affect traffic, credentials, and internal access. Urgency depends on confirmed device presence and management-interface exposure.

Technical view

The CVE describes a stack buffer overflow in /goform/setVLAN on Tenda AC11 firmware through 02.03.01.104_CN. A crafted POST request can allow arbitrary code execution on the system. The provided metadata has no CVSS score, CWE, CPEs, authentication detail, or confirmed remediation.

Likely exposure

Exposure is likely limited to environments using Tenda AC11 devices on firmware through 02.03.01.104_CN where the vulnerable web endpoint is reachable by an attacker. The bundle does not establish whether authentication is required or whether WAN-facing management is common.

Exploitation context

The CVE states arbitrary code execution is possible via a crafted POST request. KEV is false, and the provided sources do not claim active exploitation in the wild. Public evidence is sparse and appears to come from vulnerability research rather than vendor guidance.

Researcher notes

Evidence is incomplete: no CVSS, CWE, CPE, authentication requirement, affected-region clarification, or official patch is included. The key source claim is arbitrary code execution through a stack overflow in /goform/setVLAN on firmware through 02.03.01.104_CN.

Mitigation direction

  • Inventory Tenda AC11 devices and firmware versions immediately.
  • Check Tenda guidance for firmware newer than 02.03.01.104_CN.
  • Restrict router management access to trusted administrative networks only.
  • Remove any internet exposure of the device management interface.
  • Replace affected devices if supported fixed firmware is unavailable.

Validation and detection

  • Confirm whether any Tenda AC11 devices run firmware through 02.03.01.104_CN.
  • Review firewall rules for WAN or untrusted access to management interfaces.
  • Check logs for unexpected requests to /goform/setVLAN.
  • Verify whether vendor firmware guidance or replacement options exist.
  • Document exposure assumptions, especially authentication and reachability.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-31757 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.