Vulnerabilidades do Tenda Ac7 Firmware

CVE-2026-51846 Crítica · 9.8 CWE-121 19/06/2026

Estouro de Buffer na Pilha no Parâmetro wanSpeed do Firmware Tenda AC7 (CVE-2026-51846)

No Tenda AC7 v15.03.06.44, o parâmetro wanSpeed da rota /goform/AdvSetMacMtuWan apresenta uma vulnerabilidade de estouro de buffer na pilha que pode levar à execução remota arbitrária de código.

CVE-2026-51845 Crítica · 9.8 CWE-121 19/06/2026

Tenda AC7: estouro de buffer baseado em pilha na interface AdvSetMacMtuWan

O Tenda AC7 v15.03.06.44 contém uma vulnerabilidade de estouro de buffer na pilha na interface /goform/AdvSetMacMtuWan por meio do parâmetro mac.

CVE-2026-51844 Crítica · 9.8 CWE-121 19/06/2026

Estouro de buffer na pilha no Tenda AC7 em AdvSetMacMtuWan via cloneType

O Tenda AC7 v15.03.06.44 contém uma vulnerabilidade de estouro de buffer na pilha (stack buffer overflow) na interface /goform/AdvSetMacMtuWan por meio do parâmetro cloneType.

CVE-2026-51843 Crítica · 9.8 CWE-121 19/06/2026

Estouro de buffer na pilha no firmware do Tenda AC7 no tratamento de wanMTU

O Tenda AC7 v15.03.06.44 contém uma vulnerabilidade de estouro de buffer na pilha (stack buffer overflow) na interface /goform/AdvSetMacMtuWan, através do parâmetro wanMTU.

CVE-2026-4974 Alta · 8.8 CWE-787 27/03/2026

Tenda AC7 POST Request SetSysTimeCfg fromSetSysTime memory corruption

A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Handler. Executing a manipulation of the argument Time can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

CVE-2026-24441 Média · 5.9 CWE-319 03/02/2026

Tenda AC7 Transmits Admin Credentials Without HTTPS Protection

Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose account credentials in plaintext within HTTP responses, allowing an on-path attacker to obtain sensitive authentication material.

CVE-2026-24434 Média · 6.5 CWE-352 03/02/2026

Tenda AC7 Web Interface Lacks CSRF Protections for Admin Actions

Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior does not implement CSRF protections for administrative functions in the web management interface. The interface does not enforce anti-CSRF tokens or robust origin validation, which can allow an attacker to induce a logged-in administrator to perform unintended state-changing requests and modify router settings.

CVE-2026-24427 Média · 5.5 CWE-201 03/02/2026

Tenda AC7 Exposes Admin Credentials in Configuration Responses

Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose sensitive information in web management responses. Administrative credentials, including the router and/or admin panel password, are included in plaintext within configuration response bodies. In addition, responses lack appropriate Cache-Control directives, which may permit web browsers to cache pages containing these credentials and enable subsequent disclosure to an attacker with access to the client system or browser profile.

CVE-2026-24426 Média · 6.1 CWE-79 03/02/2026

Tenda AC7 Reflected XSS via Web Interface Output Encoding

Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior contain an improper output encoding vulnerability in the web management interface. User-supplied input is reflected in HTTP responses without adequate escaping, allowing injection of arbitrary HTML or JavaScript in a victim’s browser context.

CVE-2025-11586 Crítica · 9.8 CWE-119 10/10/2025

Tenda AC7 setNotUpgrade stack-based overflow

A vulnerability was determined in Tenda AC7 15.03.06.44. This affects an unknown function of the file /goform/setNotUpgrade. This manipulation of the argument newVersion causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2025-11528 Alta · 8.8 CWE-119 09/10/2025

Tenda AC7 saveAutoQos stack-based overflow

A vulnerability was identified in Tenda AC7 15.03.06.44. This affects an unknown function of the file /goform/saveAutoQos. The manipulation of the argument enable leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

CVE-2025-11527 Alta · 8.8 CWE-119 09/10/2025

Tenda AC7 fast_setting_pppoe_set stack-based overflow

A vulnerability was determined in Tenda AC7 15.03.06.44. The impacted element is an unknown function of the file /goform/fast_setting_pppoe_set. Executing a manipulation of the argument Password can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2025-11526 Alta · 8.8 CWE-119 09/10/2025

Tenda AC7 WifiMacFilterSet stack-based overflow

A vulnerability was found in Tenda AC7 15.03.06.44. The affected element is an unknown function of the file /goform/WifiMacFilterSet. Performing a manipulation of the argument wifi_chkHz results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.

CVE-2025-11525 Alta · 8.8 CWE-119 08/10/2025

Tenda AC7 SetUpnpCfg stack-based overflow

A vulnerability has been found in Tenda AC7 15.03.06.44. Impacted is an unknown function of the file /goform/SetUpnpCfg. Such manipulation of the argument upnpEn leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-11524 Alta · 8.8 CWE-119 08/10/2025

Tenda AC7 SetDDNSCfg stack-based overflow

A flaw has been found in Tenda AC7 15.03.06.44. This issue affects some unknown processing of the file /goform/SetDDNSCfg. This manipulation of the argument ddnsEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.

CVE-2025-11523 Alta · 8.8 CWE-77 08/10/2025

Tenda AC7 AdvSetLanip command injection

A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

CVE-2018-14558 Crítica · 9.8 KEV Alta · 62 CWE-78 30/10/2018

Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input.