Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZSetCfg of the file /goform/mDMZSetCfg. The manipulation of the argument dmzIp results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
| Date | Total | Labels |
|---|
| 2026-01-29 | 1 | Disclosure1 |
| 2026-01-30 | 2 | Disclosure1General1 |
CVE-2026-1638 Command Injection Vulnerability in Tenda AC21 Router via mDMZSetCfg Function https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1638
Post summary
The brief notice discloses a command injection flaw in Tenda AC21 routers through the mDMZSetCfg function, but does not provide PoC details, exploit code, or patch information.
It is possible to see elevated activities targeting Tenda AC21 (CVE-2026-1638) https://vuldb.com/?ctiid.343417
Post summary
The message only notes potential heightened activity against Tenda AC21 for CVE‑2026‑1638 without detailing PoC, exploit, or mitigation.
CVE-2026-1638 A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZSetCfg of the file /goform/mDMZSetCfg. The manip… https://www.cve.org/CVERecord?id=CVE-2026-1638
Post summary
The text provides a basic disclosure of CVE‑2026‑1638, identifying the vulnerable function in Tenda AC21 but offering no PoC, exploit code, active exploitation evidence, patch, or false‑positive claim.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | tenda | ac21 | - | - | - |
| OS | tenda | ac21_firmware | 16.03.08.16 | - | - |