A vulnerability labeled as critical has been found in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function
mDMZSetCfg of the file /goform/mDMZSetCfg. The manipulation of the argument dmzIp results in command injection.
This vulnerability is identified as CVE-2026-1638. The attack can be executed remotely. Additionally, an exploit exists.
