What is the CVSS score of CVE-2026-51843?

CVE-2026-51843 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Tenda AC7 are affected by CVE-2026-51843?

Tenda AC7 router firmware v15.03.06.44 contains a critical unauthenticated remote code execution vulnerability (CVE-2026-51843, CVSS 9.8) accessible over the network.

How to fix or mitigate CVE-2026-51843?

Within 24 hours: Identify and inventory all Tenda AC7 routers with firmware v15.03.06.44; disable remote management access via firewall rules blocking external connections to router management ports. Within 7 days: Implement network segmentation isolating affected routers from production systems; establish monitoring for requests to /goform/AdvSetMacMtuWan endpoint. Within 30 days: Execute hardware replacement plan to alternative router models from vendors with demonstrated patch release practices; evaluate any Tenda firmware updates as interim measure only, pending complete migration.

Tenda AC7 CVE-2026-51843

EUVD-2026-38049 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-06-19 cve@mitre.org

GHSA-8wjp-x79j-qqmp

Stack Overflow Buffer Overflow Tenda Ac7 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Web-reachable /goform endpoint with no stated auth gives AV:N/AC:L/PR:N/UI:N; stack overflow in router httpd typically yields root, so C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 19:08 vuln.today

CVSS changed

Jun 22, 2026 - 18:23 NVD

9.8 (CRITICAL)

CVE Published

Jun 19, 2026 - 17:16 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the wanMTU parameter.

AnalysisAI

Stack buffer overflow in Tenda AC7 router firmware v15.03.06.44 allows remote attackers to corrupt memory through the wanMTU parameter of the /goform/AdvSetMacMtuWan web management endpoint. The CVSS 9.8 rating reflects network-reachable, unauthenticated exploitation with full impact on confidentiality, integrity, and availability, though no public exploit identified at time of analysis. The flaw is classified as CWE-121 (stack-based buffer overflow), a class historically leveraged for code execution or denial of service on embedded MIPS/ARM SOHO routers.

Technical ContextAI

Tenda AC7 is a consumer-grade dual-band 802.11ac wireless router whose web administration interface exposes /goform/* CGI-style handlers implemented in the httpd binary running on the device. CWE-121 (stack-based buffer overflow) indicates that the wanMTU request parameter is copied into a fixed-size stack buffer without adequate length validation, typical of unchecked strcpy/sprintf/memcpy patterns common in Tenda's Realtek/Broadcom-based firmware. Successful overflow on these MIPS-based devices commonly overwrites the saved return address, enabling control-flow hijack subject to ASLR/NX, which are frequently absent or weak in Tenda firmware.

RemediationAI

No vendor-released patch identified at time of analysis; Tenda has not published an advisory or fixed firmware version in the supplied data. Until a fix is released, administrators should disable WAN-side access to the web management interface (the AC7 'Remote Web Management' toggle) so /goform/AdvSetMacMtuWan is unreachable from the Internet, restrict LAN-side access to a management VLAN or trusted MAC list, change default admin credentials, and consider isolating or replacing the device if it is internet-exposed; the trade-off of disabling remote management is loss of off-LAN administration, which is acceptable for most home/SMB deployments. Monitor the referenced researcher writeup (https://www.kdev.site/cve-request_008/) and Tenda's official support portal for firmware newer than 15.03.06.44 that addresses CWE-121 in the AdvSetMacMtuWan handler.