CVE-2026-51844: Tenda AC7 v15

Synopsis

A stack-based buffer overflow in the Tenda AC7 v15.03.06.44 router firmware allows an unauthenticated attacker to send a crafted request to the /goform/AdvSetMacMtuWan interface with a malicious cloneType parameter value. The vulnerability is reachable over the network and requires no authentication or user interaction to trigger. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the device, enabling remote code execution. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable interface is exposed over the network, so the attacker must be able to reach the device's HTTP service remotely.

• AuthenticationNot required

  No credentials or session token of any kind are needed to send a malicious request to the affected endpoint.

• Victim interactionNot required

  The attack is fully server-side and completes without any action from a user or administrator of the device.

• Attack complexityDetail

  Exploitation is reliable and condition-free - no race conditions, specific memory layouts, or environmental prerequisites are required.

Blast Radius

• A successful attacker achieves remote code execution on the router, gaining full control over the device.
• All data passing through or stored on the device, including credentials and session material, is readable by the attacker.
• The attacker can modify device configuration, routing rules, and persisted settings arbitrarily.
• The attacker can crash the device or render it permanently unavailable, disrupting all network traffic the router handles.