CVE-2021-27691: attackers can run commands on it
DO THIS FIRSTFind out if you use it. If you do, apply the vendor's fix. Not sure if you use it? Send this page to your IT provider or security lead and ask.
TECHNICAL SUMMARY Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request.
WHY THIS VERDICT Attack attempts are confirmed, with no confirmed exploitation yet.
WHY IT RANKS HERE The first report is 20 days old.
- HIGHEST CONFIRMED RUNG
- TRIED
- CISA KEV
- NOT YET
- EXPLOIT CODE
- NONE KNOWN
How far has it climbed?
01 TALK
□ NO EVIDENCE YETNEWEST EVIDENCE NONE YETNo evidence yet.
SRC: NONE YET02 EXPOSED
□ NOT TRACKED YETNO SOURCE FOR THIS STEP YETWe have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.
03 TRIED
■ CONFIRMEDNEWEST EVIDENCE · 1 SOURCEAttack attempts on CVE-2021-27691 seen by honeypots (Shadowserver via CIRCL). Attack attempts on CVE-2021-27691 seen by honeypots (Shadowserver via CIRCL).
04 EXPLOITED
□ NO EVIDENCE YETNEWEST EVIDENCE NONE YETNo evidence yet.
SRC: NONE YET05 DAMAGE
□ NOT TRACKED YETNO SOURCE FOR THIS STEP YETBreach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.
When each thing happened
- DISCLOSED
- EXPLOIT CODE PUBLICNOT YET
- FIRST ATTACK REPORT
- CISA KEV LISTINGNOT YET
- US FEDERAL DEADLINENOT YET
How it unfolded
- Attack activity. OCT 21, 2026Attack attempts on CVE-2021-27691 seen by honeypots (Shadowserver via CIRCL) (2 reports, latest OCT 22)