CVE-2026-51843
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A stack buffer overflow vulnerability exists in Tenda AC7 firmware version 15.03.06.44 in the /goform/AdvSetMacMtuWan interface via the wanMTU parameter. An attacker can remotely crash the device or potentially execute arbitrary code.
Risk Assessment
The risk includes remote code execution or denial of service (DoS), potentially leading to network integrity compromise and data confidentiality loss.
Recommendation
Immediately update the Tenda AC7 firmware to the latest available version, or apply temporary network security measures such as filtering traffic to the management interface.
Other vulnerabilities in Tenda AC7
See all- CVE-2026-51846Critical
In Tenda AC7 firmware version 15.03.06.44, a stack buffer overflow vulnerability exists in the wanSpeed parameter of the /goform/AdvSetMacMtuWan route. This can lead to remote arbitrary code execution.
- CVE-2026-51845Critical
A stack buffer overflow vulnerability was discovered in the Tenda AC7 router firmware version 15.03.06.44 in the /goform/AdvSetMacMtuWan interface via the mac parameter. An attacker can remotely crash the device or potentially execute arbitrary code.
- CVE-2026-51844Critical
A stack buffer overflow vulnerability was discovered in the Tenda AC7 router firmware version 15.03.06.44 in the /goform/AdvSetMacMtuWan interface via the cloneType parameter. An attacker can exploit this flaw to execute arbitrary code remotely or cause a denial of service.
- CVE-2025-11523Medium
A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
Original NVD description (English source)
Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the wanMTU parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS