CVE-2026-2148: Tenda AC21 Web Management DownloadFlash information disclosure

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-08 · updated 2026-06-17
Weakness: CWE-200

Description

A security vulnerability has been detected in Tenda AC21 16.03.08.16. Affected is an unknown function of the file /cgi-bin/DownloadFlash of the component Web Management Interface. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

Affected products

Tenda AC21: 16.03.08.16

References

https://github.com/master-abc/cve/issues/27
https://vuldb.com/?ctiid.344850
https://vuldb.com/?id.344850
https://vuldb.com/?submit.747557
https://www.tenda.com.cn/

Get alerted when CVE-2026-2148 or the next vulnerability affects your stack