Tenda AC21 router firmware version V16.03.08.16 contains a buffer overflow vulnerability in the list parameter of the /goform/setPptpUserList endpoint. This flaw can cause a denial of service by crashing the device but does not impact confidentiality or integrity.