CVE-2026-51846: In Tenda AC7 v15

Synopsis

A stack-based buffer overflow in the Tenda AC7 v15.03.06.44 firmware allows an unauthenticated attacker to reach the vulnerable endpoint over the network by sending a crafted wanSpeed parameter to the /goform/AdvSetMacMtuWan route. No login or user interaction is required. Successful exploitation gives the attacker full remote code execution on the device. No fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's web interface over the network; the vulnerable route is exposed via the HTTP management service.

• AuthenticationNot required

  No credentials are needed; the /goform/AdvSetMacMtuWan endpoint is reachable without any prior authentication.

• Victim interactionNot required

  The attacker sends a crafted request directly to the device; no user action or social engineering is involved.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or memory-layout dependencies.

Blast Radius

• The attacker executes arbitrary code on the device with the privilege level of the firmware process, giving full control of the router.
• Network traffic routed through the device can be intercepted, redirected, or inspected, exposing all connected clients.
• Persistent configuration changes can be made, including adding rogue accounts, altering DNS settings, or disabling firewall rules.
• The device can be crashed or rendered unresponsive, cutting off network access for all downstream hosts.