CVE-2021-46394

There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v13 variable is directly retrieved from the http request parameter startIp. Then v13 will be splice to stack by function sscanf without any security check, which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp, the attacker can easily perform remote code execution with carefully crafted overflow data.

• CWE-787

• https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX3/4Exploit, Third Party Advisory
• https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX3/4Exploit, Third Party Advisory

Published

Mar 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-46386File upload vulnerability in mingSoft MCMS through 5.2.5, al…9.8
• CVE-2021-46387ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected …6.1
• CVE-2021-46388Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-46389IIPImage High Resolution Streaming Image Server prior to com…7.5
• CVE-2021-46390An access control issue in the authentication module of Lexa…6.8
• CVE-2021-46393There is a stack buffer overflow vulnerability in the formSe…9.8
• CVE-2021-46398A Cross-Site Request Forgery vulnerability exists in Filebro…8.8
• CVE-2021-46408Tenda AX12 v22.03.01.21 was discovered to contain a stack bu…7.5
• CVE-2021-46416Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmw…8.1
• CVE-2021-46417Insecure handling of a download function leads to disclosure…7.5
• CVE-2021-46418An unauthorized file creation vulnerability in Telesquare TL…7.5
• CVE-2021-46419An unauthorized file deletion vulnerability in Telesquare TL…9.1