Tenda AC7 CVE-2026-51844

Exploitation requires network reachability to the router's HTTP management interface on the port where /goform/AdvSetMacMtuWan is served (default LAN web UI, or WAN if 'Remote Web Management' has been enabled by the operator), and the device must be running firmware 15.03.06.44 (other builds not enumerated in the provided data). Per the CVSS vector PR:N/UI:N, no authentication and no user interaction are required, so on a device with the management UI exposed this is a one-shot unauthenticated request. The principal limiting factor in practice is that most AC7 deployments expose the web UI only on the LAN, so external exploitation depends on the operator having enabled remote management or on the attacker already having a LAN foothold or a CSRF/DNS-rebinding pivot.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N rates this as critical (9.8) and remotely exploitable without authentication or user interaction, which is consistent with the described pre-auth /goform handler reachable over HTTP. EPSS score was not provided in the input data, KEV status is not listed, and no proof-of-concept link is included beyond a third-party request reference (kdev.site). Real-world risk is elevated for any AC7 device whose admin interface is exposed to untrusted networks (WAN or guest VLAN), but is materially reduced for devices that only expose the web UI on the LAN; given consumer SOHO routers are rarely patched, exposure to LAN-side attackers (e.g., via a compromised IoT device or malicious browser-initiated CSRF reaching the LAN IP) remains a credible threat path. Note: the only reference provided is a non-vendor URL, so vendor confirmation and an authoritative fix version could not be independently verified from the input.

An attacker on the same network segment as the router (or on the Internet if remote management is enabled) sends a single crafted HTTP POST to /goform/AdvSetMacMtuWan with an overlong cloneType value, smashing the stack of the httpd process and redirecting execution to attacker-controlled shellcode or a ROP chain on the MIPS firmware. Successful exploitation yields code execution as the web daemon (typically root on Tenda firmware), enabling persistent backdooring, DNS hijacking, or use of the device as a botnet node. No public exploit was identified at time of analysis, but the bug class and endpoint are well-understood and reverse engineering of the firmware is straightforward.