CVE-2026-1638: Tenda AC21 Router RCE Vulnerability

CVE-2026-1638 Overview

A command injection vulnerability has been identified in the Tenda AC21 router firmware version 1.1.1.1/1.dmzip/16.03.08.16. The vulnerability exists within the mDMZSetCfg function located in the /goform/mDMZSetCfg endpoint. An attacker can exploit this flaw by manipulating the dmzIp argument to inject arbitrary system commands. This vulnerability can be exploited remotely over the network, and public exploit code has been made available, increasing the risk of active exploitation in the wild.

Critical Impact

Remote attackers with low privileges can execute arbitrary commands on affected Tenda AC21 routers by exploiting the command injection vulnerability in the DMZ configuration functionality.

Affected Products

• Tenda AC21 firmware version 1.1.1.1
• Tenda AC21 firmware version 1.dmzip
• Tenda AC21 firmware version 16.03.08.16

Discovery Timeline

• 2026-01-30 - CVE-2026-1638 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-1638

Vulnerability Analysis

This vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly known as injection. The affected function mDMZSetCfg fails to properly sanitize user-supplied input in the dmzIp parameter before using it in a system command context. When a user submits a DMZ configuration request through the web interface, the router firmware processes the IP address parameter without adequate validation, allowing specially crafted input to break out of the intended command context and execute arbitrary system commands.

The vulnerability is remotely exploitable over the network with low attack complexity. An attacker requires low-level privileges (authenticated access to the router's web interface) but no user interaction is needed beyond the initial request. The impact includes potential compromise of confidentiality, integrity, and availability of the affected device, though each impact category is rated as low in isolation.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the mDMZSetCfg function. The firmware directly incorporates the dmzIp parameter value into shell commands without proper sanitization or escaping of special characters. This allows command separator characters (such as ;, |, &, or newlines) to terminate the intended command and inject malicious commands that execute with the privileges of the web server process, typically root on embedded devices like routers.

Attack Vector

The attack vector is network-based, targeting the /goform/mDMZSetCfg endpoint exposed by the router's web management interface. An authenticated attacker can craft a malicious HTTP request containing shell metacharacters in the dmzIp parameter. When the vulnerable function processes this input, the injected commands are executed on the underlying operating system.

Typical exploitation involves sending a POST request to the affected endpoint with a payload such as a semicolon followed by arbitrary commands in the dmzIp field. Since routers typically run with elevated privileges, successful exploitation can lead to complete device compromise, including:

• Modification of router configuration
• Interception or manipulation of network traffic
• Use of the router as a pivot point for further attacks
• Installation of persistent backdoors in the firmware

For detailed technical information, refer to the GitHub CVE Issue Discussion and VulDB #343417.

Detection Methods for CVE-2026-1638

Indicators of Compromise

• Unusual HTTP POST requests to /goform/mDMZSetCfg containing shell metacharacters (;, |, &, backticks, $()) in the dmzIp parameter
• Unexpected processes spawned by the web server process on the router
• Modified router configurations, especially DMZ settings that contain non-IP address values
• Outbound network connections from the router to unknown external hosts

Detection Strategies

• Implement network intrusion detection rules to monitor for malformed requests to /goform/mDMZSetCfg endpoints containing command injection patterns
• Deploy web application firewall (WAF) rules to filter requests containing shell metacharacters in form parameters
• Enable and review router access logs for suspicious authentication attempts and configuration changes
• Monitor for anomalous DNS queries or network traffic originating from router management interfaces

Monitoring Recommendations

• Configure SIEM alerts for any access to /goform/mDMZSetCfg with non-standard parameter values
• Implement egress filtering to detect compromised routers attempting to communicate with command-and-control infrastructure
• Regularly audit router configurations to detect unauthorized changes to DMZ settings
• Monitor for firmware integrity changes that could indicate persistent compromise

How to Mitigate CVE-2026-1638

Immediate Actions Required

• Restrict access to the router's web management interface to trusted internal networks only
• Disable remote management functionality if not strictly required
• Implement strong authentication credentials and change default passwords
• Place the router behind a firewall that filters access to management interfaces
• Monitor for and apply firmware updates from Tenda as they become available

Patch Information

At the time of this writing, no official patch has been confirmed from Tenda. Users should monitor the Tenda Security Information page for firmware updates addressing this vulnerability. Given that public exploit information is available, applying patches as soon as they are released is strongly recommended.

For tracking purposes, this vulnerability is documented in VulDB CTI ID #343417 and VulDB Submission #740871.

Workarounds

• Disable the web management interface entirely and manage the router through console access if possible
• Implement network segmentation to isolate the router's management interface from untrusted networks
• Configure access control lists (ACLs) to restrict which IP addresses can access the management interface
• Consider replacing vulnerable devices with alternative hardware that receives regular security updates

# Example: Restrict management interface access via firewall rules
# Block external access to router management port (adjust IP and port as needed)
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP

# Allow management access only from specific admin workstation
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.100 -j ACCEPT