CVE-2026-51843: Tenda AC7 firmware stack buffer overflow in wanMTU handler
CVE-2026-51843 is a stack-based buffer overflow (CWE-121) in Tenda AC7 firmware version 15.03.06.44, reachable through the /goform/AdvSetMacMtuWan interface. NVD rates it critical with a CVSS 3.1 base score of 9.8 and a network attack vector requiring no privileges or user interaction. The record shows no KEV listing, no EPSS score and no fixed version.
Overview
CVE-2026-51843 describes a stack-based buffer overflow in Tenda AC7 firmware version 15.03.06.44. The record places the flaw in the /goform/AdvSetMacMtuWan interface and associates it with the wanMTU parameter. The weakness is classified as CWE-121.
Impact
NVD assigns a CVSS 3.1 base score of 9.8 (critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network-reachable flaw needing no privileges or user interaction and with high confidentiality, integrity and availability impact.
- Stack overflows generally can corrupt memory and crash the affected service. Depending on the device and conditions, they may also enable further abuse. The record does not state the consequences for this specific device.
- Because the scored vector indicates high impact on all three security properties, the affected device should be treated as a priority for review.
Affected products and versions
- Product listed in the record: Tenda AC7 Firmware.
- Version listed in the record: 15.03.06.44.
- The record does not list other affected versions, so the scope beyond this version is unknown.
Exploitation status
The record shows that the CISA KEV catalog does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. One reference (kdev.site) carries an Exploit tag in the record. That tag indicates the link is associated with exploit-related material, but it does not confirm that attacks have occurred.
Remediation and mitigation
- No fixed version is listed in the record. The absence of a listed fix does not mean no fix exists, so check the vendor's support channels for firmware updates for the AC7 line.
- Until an update is confirmed, restrict access to the device's web management interface. Do not expose it to untrusted networks, and limit administrative access to dedicated management hosts.
- If the device is end-of-life or no longer receives firmware updates, plan replacement or isolate it behind network segmentation.
Detection guidance
- Inventory Tenda AC7 devices and record firmware versions to identify any running 15.03.06.44.
- Review web server and device logs for unexpected requests to management endpoints, and investigate crashes or unexplained restarts of the web service.
- Monitor network traffic reaching device management ports from external or unexpected sources.
Limitations of the available information
The record provides no vendor advisory, no fixed version, no EPSS score, no SSVC data and no confirmed exploitation timeline. The description does not state the exact consequences of exploitation. Conclusions about scope and impact beyond the listed version are unknown.
Frequently asked questions
What is CVE-2026-51843?
It is a stack-based buffer overflow (CWE-121) in Tenda AC7 firmware version 15.03.06.44, associated with the /goform/AdvSetMacMtuWan interface and the wanMTU parameter.
Is this vulnerability known to be actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. One reference carries an Exploit tag, which does not by itself confirm attacks.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.