CVE-2026-1638

A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZSetCfg of the file /goform/mDMZSetCfg. The manipulation of the argument dmzIp results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

• CWE-74
• CWE-77
• CWE-77

• https://github.com/LX-LX88/cve/issues/26Broken Link
• https://vuldb.com/?ctiid.343417Permissions Required, VDB Entry
• https://vuldb.com/?id.343417Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.740871Third Party Advisory, VDB Entry
• https://www.tenda.com.cn/Product

Published

Jan 30, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16374Information disclosure in the Framework component in DevTool…7.5
• CVE-2026-16375Site isolation issue in the Networking: HTTP component. This…9.8
• CVE-2026-16376Denial-of-service in the Graphics: WebGPU component. This vu…7.5
• CVE-2026-16377Mitigation bypass in the PDF Viewer component. This vulnerab…9.8
• CVE-2026-16378Other issue in the DOM: Copy & Paste and Drag & Drop compone…7.5
• CVE-2026-16379Privilege escalation in the DOM: Content Processes component…8.8
• CVE-2026-16380Mitigation bypass in the Networking component. This vulnerab…9.1
• CVE-2026-16381Same-origin policy bypass in the Networking: DNS component. …9.1
• CVE-2026-16382Mitigation bypass in the DOM: Service Workers component. Thi…9.8
• CVE-2026-16383Mitigation bypass in the DOM: Networking component. This vul…9.8
• CVE-2026-16384Information disclosure due to uninitialized memory in the Gr…7.5
• CVE-2026-16385Information disclosure due to uninitialized memory in the Gr…7.5