Ac7 Firmware CVE-2026-4974

Requires authenticated access to Tenda AC7 router (firmware 15.03.06.44). Attacker must be a logged-in user with access to the /goform/SetSysTimeCfg POST endpoint to send a crafted Time parameter triggering stack-based buffer overflow.

The CVSS 4.0 score of 7.4 reflects high severity with complete confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). The attack vector analysis shows network-accessible exploitation (AV:N) with low complexity (AC:L) requiring only low privileges (PR:L), making this highly practical to exploit. The CVSS E:P metric confirms proof-of-concept exploit code exists and has been publicly disclosed via the Notion document reference, significantly lowering the barrier to exploitation. While no CISA KEV listing or EPSS score is provided in the data, the combination of public exploit availability, low attack complexity, authenticated but low-privilege requirement, and complete system impact elevates real-world risk substantially. The authentication requirement (PR:L) provides minimal protection since consumer routers often have default credentials or weak passwords. For organizations using Tenda AC7 routers in production environments, this represents an immediate priority requiring emergency patching or device replacement, as authenticated network access to router management interfaces is commonly achievable by internal threat actors or via credential compromise.

An attacker who has obtained low-privilege credentials to the Tenda AC7 web management interface (through credential stuffing, default passwords, or social engineering) connects to the router over the network and sends a malicious POST request to /goform/SetSysTimeCfg with an oversized Time parameter value crafted to overflow the stack buffer. This overwrites the return address on the stack, redirecting execution to attacker-controlled shellcode that establishes persistent backdoor access to the router, allowing traffic interception, DNS hijacking, or pivot points into the internal network. Publicly available exploit code exists demonstrating this attack path, making exploitation straightforward for actors with basic network access.