Tenda AC7 CVE-2025-11526

Requires network access to the Tenda AC7 web management interface AND a valid low-privilege authenticated session (CVSS PR:L) - it is not anonymous/unauthenticated. The specific trigger is a request to the /goform/WifiMacFilterSet endpoint with an oversized wifi_chkHz argument that overflows a stack buffer. Limiting factors: exploitation is constrained to the exact AC7 firmware 15.03.06.44, requires credentials/an established session, and in typical SOHO deployments the management interface is LAN-facing rather than internet-exposed, so WAN exploitation depends on remote-management being enabled. No user interaction is required (UI:N).

Signals are moderate and internally consistent rather than alarming. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high impact to confidentiality, integrity and availability yields 7.4, reflecting network reachability but requiring at least low-level privileges (PR:L) - i.e. an authenticated session on the router's management interface, not anonymous access. A public POC exists (GitHub, noahze01/IoT-vulnerable), so exploit code is available, but this is NOT the same as active exploitation: the CVE is not listed in CISA KEV. EPSS is low at 0.80% (55th percentile), which is consistent with the PR:L precondition and the niche consumer-router target - meaning widespread automated mass-exploitation is unlikely despite public POC code. The 'E:P' (Proof-of-Concept) in the CVSS 4.0 threat metric aligns with POC availability and the absence of confirmed in-the-wild use. Net assessment: this is a genuine code-execution-class flaw with public exploit code, but the authentication requirement and the limited deployment footprint of a single Tenda SOHO router model make it a moderate, not top-tier, priority for most environments - prioritize where this exact model/firmware is exposed. Note one caveat: CWE-119 and 'stack-based buffer overflow' imply potential arbitrary code execution, but neither the description nor VulDB independently confirms achieved RCE versus crash/DoS - verify the actual impact against the POC.

An attacker with access to the Tenda AC7 web management interface and a valid (low-privilege) session sends a crafted request to /goform/WifiMacFilterSet containing an oversized value in the wifi_chkHz parameter, overflowing a stack buffer. A public proof-of-concept is available, lowering the skill barrier, and a successful overflow can crash the device or potentially execute attacker-controlled code on the router. Because PR:L is required, the attacker must first reach and authenticate to the management interface, which in typical deployments is LAN-facing.