Tenda AC7 CVE-2026-51843

Exploitation requires network reachability to the AC7's HTTP management service on the affected firmware 15.03.06.44, plus the ability to issue a POST to the /goform/AdvSetMacMtuWan endpoint with an attacker-controlled wanMTU parameter; the CVSS vector marks PR:N and UI:N, implying no authentication or user interaction is needed, but the description does not explicitly confirm whether AdvSetMacMtuWan is reachable pre-authentication, so internet-wide pre-auth exploitation should be treated as plausible but not verified. Realistic limiting factors are that Tenda's 'Remote Web Management' is disabled by default, restricting most deployments to LAN-side attackers, and reliable code execution (versus a crash) further depends on the device's specific MIPS/ARM build, ASLR/NX posture, and absence of stack canaries in httpd.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H portrays a worst-case remotely exploitable, unauthenticated flaw with full impact, yielding a 9.8 critical score; however, real-world risk hinges on whether the /goform/AdvSetMacMtuWan handler is reachable without prior authentication, which the description does not explicitly confirm - Tenda's web UI normally enforces session authentication, so the PR:N rating may overstate exposure if pre-auth reach is actually limited to the LAN side. No EPSS score, no KEV listing, and no public POC were provided, and the sole reference (kdev.site) is a researcher submission portal rather than a vendor advisory, so exploitation likelihood is currently unverified. Practical risk is highest where the web UI is exposed to the WAN (a non-default but common misconfiguration), in which case mass scanning of Tenda fingerprints could enable opportunistic exploitation.

An attacker who can reach the AC7 web interface - either on the LAN or through a router whose remote management is enabled on the WAN - sends a crafted HTTP POST to /goform/AdvSetMacMtuWan with an oversized wanMTU value, overflowing the stack buffer in httpd and either crashing the router (denial of service) or, with a working ROP chain against the MIPS firmware, achieving code execution as the httpd process (typically root on Tenda devices). No public exploit identified at time of analysis, but stack overflow patterns in other Tenda /goform/* handlers have been weaponized historically, making POC development a realistic next step.