CVE-2026-51844: Tenda AC7 Stack Buffer Overflow in AdvSetMacMtuWan via cloneType
CVE-2026-51844 is a stack-based buffer overflow (CWE-121) reported in Tenda AC7 firmware v15.03.06.44, triggered through the cloneType parameter of the /goform/AdvSetMacMtuWan interface. NVD and a second scoring provider both rate it CVSS 3.1 9.8 (Critical), and no fixed version is listed in the record. CISA KEV does not list it and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-51844 affects the Tenda AC7 router firmware version v15.03.06.44. According to the record, a stack buffer overflow exists in the /goform/AdvSetMacMtuWan interface and can be reached through the cloneType parameter. The weakness is classified as CWE-121, Stack-based Buffer Overflow.
Impact
The NVD and a second scoring provider both assign CVSS 3.1 base score 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network attack vector, low complexity, no privileges and no user interaction, with high confidence, integrity and availability impact. Based on that vector, a successful attack could plausibly compromise the device, but the record does not describe the consequences in detail.
Affected products and versions
- Tenda AC7 firmware, version v15.03.06.44
The record lists no other affected versions and no fixed versions. This does not mean no fix exists; it means the record does not provide that information.
Exploitation status
The CISA KEV catalog does not list this CVE, so the record does not confirm active exploitation. One third-party reference is tagged as exploit-related in the record, but that tag alone does not confirm exploitation in the wild. No EPSS score is available in the record.
Remediation and mitigation
- Check the Tenda support channels for a firmware update that addresses this issue, and apply it if available.
- Restrict access to the web management interface, especially from untrusted networks, and disable remote management where it is not required.
- Place affected devices behind network segmentation so that management interfaces are not exposed to the internet or to general user networks.
- Inventory AC7 devices and confirm the firmware version in use.
Detection guidance
- Review web server or device logs for unusual or malformed requests to /goform/ paths, particularly to AdvSetMacMtuWan.
- Monitor for unexpected device restarts, configuration changes or outbound connections from the router.
Limitations of the available information
The record provides no vendor advisory, no fixed version, no patch details and no EPSS score. The title was not supplied and was written for this analysis. Its reference list contains a single third-party page, and the sources consulted do not independently confirm the technical details.
Frequently asked questions
Is CVE-2026-51844 being actively exploited?
The record shows that CISA KEV does not list this CVE, and the sources consulted do not confirm exploitation in the wild. One reference is tagged as exploit-related, but that tag alone is not confirmation.
Which Tenda AC7 version is affected?
The record lists firmware version v15.03.06.44. No other affected versions are listed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.