Back Feedly

CVE-2026-4565 - Exploits & Severity

Feedly • March 23, 2026

Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)

A buffer overflow vulnerability exists in Tenda AC21 version 16.03.08.16. The vulnerability is located in the formSetQosBand function of the /goform/SetNetControlList file. Improper handling of the argument list can result in a buffer overflow condition, allowing manipulation of memory boundaries.

An authenticated attacker with low privilege access can exploit this vulnerability over the network without user interaction to cause a buffer overflow. Successful exploitation could result in high-impact compromise including unauthorized access to sensitive data (confidentiality impact), modification of system data or functionality (integrity impact), and denial of service through system crash or degradation (availability impact). The vulnerability can be exploited remotely and proof-of-concept code is publicly available.

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch information not provided in available data.

Immediately prioritize patching Tenda AC21 devices running version 16.03.08.16 or earlier. Until patches are available, implement network-level access controls to restrict access to the affected endpoint (/goform/SetNetControlList). Consider disabling QoS configuration features if not required. Monitor for signs of exploitation attempts. Check with Tenda for firmware updates addressing this vulnerability. Restrict administrative access to trusted networks and accounts only.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Feedly found the first article mentioning CVE-2026-4565 . See article

NVD published the first details for CVE-2026-4565

A CVSS base score of 8.8 has been assigned.

The Weekly Breach: 7 Maximum CVSS Flaws and the DarkSword Exploit Unveiled

d3cfe45d-5b8b-47b6-a392-5bd543e086e8

Collect, analyze, and vulnerability reports faster using AI

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Buffer Overflow Vulnerabilities in Tenda Devices Identified Two significant buffer overflow vulnerabilities have been discovered in Tenda devices. CVE-2026-4553 affects Tenda F453 firmware version 1.0.0.3, allowing authenticated attackers to exploit a stack-based buffer overflow via the /goform/Natlimit component. This vulnerability has a CVSS score of 8.8 and could lead to complete system compromise. CVE-2026-4565 impacts Tenda AC21 version 16.03.08.16, where improper handling of arguments in the /goform/SetNetControlList file can also be exploited by low-privilege authenticated users. This vulnerability similarly has a CVSS score of 8.8 and can result in unauthorized access and denial of service. Both vulnerabilities require network access and low-level authentication but do not necessitate user interaction. Currently, no patches are available for either vulnerability, and monitoring for suspicious activity is advised. 7 sources 71

Extracted Entities

CVEs (1)

CVE-2026-4565