CVE-2026-51845: Tenda AC7 Stack-based Buffer Overflow in AdvSetMacMtuWan Interface
CVE-2026-51845 describes a stack-based buffer overflow (CWE-121) in the /goform/AdvSetMacMtuWan interface of Tenda AC7 firmware version 15.03.06.44, triggered through the mac parameter. NVD scores it 9.8 (Critical) under CVSS 3.1 with network attack vector and no privileges or user interaction required. The record shows no KEV listing, no EPSS data and no fixed version.
Overview
CVE-2026-51845 is a stack-based buffer overflow (CWE-121) affecting Tenda AC7 firmware version 15.03.06.44. According to the CVE description, the flaw can be reached through the /goform/AdvSetMacMtuWan interface when the mac parameter is processed. The CVE record was published on 2026-06-19 and is marked as Analyzed.
Impact
NVD assigns a CVSS 3.1 base score of 9.8 (Critical), with a vector that indicates network attack vector, low complexity, no privileges, no user interaction, and high impact on confidentiality, integrity and availability. A second scoring provider in the record also lists 9.8 under CVSS 3.1.
Stack buffer overflows can corrupt adjacent memory on the device. Depending on device conditions, this may lead to a crash or service disruption. Whether code execution is possible is not established by the record and is an inference that would require vendor or independent technical analysis.
Affected products and versions
- Tenda AC7 firmware, version 15.03.06.44, as listed in the record.
- No other affected versions are identified in the sources consulted.
Exploitation status
The CVE is not listed in the CISA KEV catalog according to the record. No confirmed active exploitation appears in the sources consulted. The record includes one third-party reference tagged as exploit-related; its content was not used as a basis for this analysis and is not reproduced here.
Remediation and mitigation
- The record lists no fixed version. This is an unknown status, not evidence that no fix exists. Check Tenda's official support channels for firmware updates for the AC7 line.
- Until a vendor fix is confirmed, limit exposure of the device's web management interface. Do not expose it to the internet, and restrict administrative access to trusted internal hosts.
- Review whether the device is reachable from untrusted networks and reduce that exposure where feasible.
- Plan replacement or isolation for devices that cannot be updated and remain in use.
Detection guidance
- Monitor unexpected traffic to the device's web management paths, especially from external or unknown sources.
- Watch for unexplained reboots, crashes or service interruptions on the router, which may indicate memory corruption.
- Review device logs and configuration changes for unauthorized modifications.
Limitations of the available information
- The record provides no vendor advisory, no fixed version, no EPSS score and no SSVC data.
- The affected version list contains only one firmware version; the scope of other releases is unknown.
- The description does not state whether authentication is needed to reach the interface, although the CVSS vector indicates no privileges required.
- Exploitability beyond the stated memory corruption is not confirmed by the sources consulted.
References: NVD entry and CVE Record.
Frequently asked questions
Is CVE-2026-51845 being actively exploited?
The record does not list this CVE in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. Monitoring for vendor updates and unusual traffic to the device's management interface is still advisable.
Which Tenda devices and versions are affected?
The record lists Tenda AC7 firmware version 15.03.06.44 only. Other versions and hardware revisions are unknown based on the available data.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.