CVE-2026-2147: Tenda AC21 Information Disclosure Flaw

CVE-2026-2147 Overview

A significant information disclosure vulnerability has been identified in Tenda AC21 routers running firmware version 16.03.08.16. This weakness affects the /cgi-bin/DownloadLog endpoint within the Web Management Interface, potentially allowing unauthorized access to sensitive log files and system information. The vulnerability can be exploited remotely without authentication, making it a serious concern for network security.

Critical Impact

Remote attackers can exploit this vulnerability to access sensitive device logs and configuration information through the Web Management Interface without authentication, potentially exposing network credentials and internal configuration details.

Affected Products

• Tenda AC21 Firmware version 16.03.08.16
• Tenda AC21 Hardware devices

Discovery Timeline

• February 8, 2026 - CVE-2026-2147 published to NVD
• February 10, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2147

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The weakness resides in the /cgi-bin/DownloadLog component of the Tenda AC21 router's Web Management Interface, which fails to properly validate or restrict access to log download functionality.

The vulnerability enables remote attackers to access device logs without proper authorization. These logs may contain sensitive information including network configuration details, connected device information, administrative actions, and potentially authentication-related data. The exploit has been publicly disclosed, increasing the risk of widespread exploitation against vulnerable devices.

Root Cause

The root cause stems from improper access controls in the web management interface's log download functionality. The /cgi-bin/DownloadLog endpoint does not adequately verify that requests originate from authenticated administrators before serving log files. This represents a failure in implementing proper authentication checks and access control mechanisms for sensitive functionality.

Attack Vector

The attack can be initiated remotely over the network. An attacker with network access to the router's web management interface can directly request the /cgi-bin/DownloadLog endpoint without providing valid authentication credentials. The attack requires no user interaction and can be performed with low complexity.

The exploitation involves sending HTTP requests to the vulnerable endpoint. Detailed technical information about the vulnerability mechanism is available in the GitHub CVE Issue Discussion and VulDB entry #344849.

Detection Methods for CVE-2026-2147

Indicators of Compromise

• Unexpected HTTP requests to /cgi-bin/DownloadLog from external or unauthorized IP addresses
• Multiple rapid requests to the log download endpoint from a single source
• Network traffic containing log file data being transmitted to unknown destinations
• Access logs showing anonymous or unauthenticated requests to the DownloadLog CGI script

Detection Strategies

• Monitor web server access logs for requests targeting /cgi-bin/DownloadLog without valid session tokens
• Implement network intrusion detection rules to alert on attempts to access the vulnerable endpoint
• Deploy web application firewall rules to block unauthorized access to CGI-bin endpoints
• Review router management interface access logs for anomalous access patterns

Monitoring Recommendations

• Enable comprehensive logging on the Tenda AC21 management interface if available
• Configure network monitoring to track all traffic to and from router management ports
• Set up alerts for access attempts to the router management interface from non-trusted networks
• Regularly review firewall logs for connection attempts to router administration ports

How to Mitigate CVE-2026-2147

Immediate Actions Required

• Restrict access to the router's web management interface to trusted internal networks only
• Implement firewall rules to block external access to the management interface (typically port 80/443)
• Disable remote management features if not required for operations
• Change default administrative credentials and implement strong passwords
• Monitor for any vendor firmware updates that address this vulnerability

Patch Information

At the time of publication, no official patch has been released by Tenda for this vulnerability. Network administrators should monitor the Tenda Official Website for firmware updates that address this security issue. In the meantime, implementing network-level access controls is strongly recommended.

Workarounds

• Configure access control lists (ACLs) on upstream network devices to restrict management interface access
• Place the router behind a firewall that blocks external access to management ports
• Use VLAN segmentation to isolate management traffic from general network traffic
• Consider disabling the web management interface entirely if command-line or other secure management methods are available
• Implement network monitoring to detect and alert on exploitation attempts

# Example iptables rules to restrict management interface access
# Allow management access only from trusted admin subnet
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
# Block all other management access
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP