What is the CVSS score of CVE-2026-51845?

CVE-2026-51845 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Tenda AC7 are affected by CVE-2026-51845?

The Tenda AC7 router (firmware v15.03.06.44) contains a critical vulnerability enabling remote, unauthenticated attacks against any organization using this SOHO model.

How to fix or mitigate CVE-2026-51845?

Within 24 hours: Identify and inventory all Tenda AC7 units currently deployed; immediately implement network isolation and disable remote administrative access. Within 7 days: Procure replacement router hardware from vendors with active security support and establish a migration timeline with IT leadership. Within 30 days: Complete replacement of all affected Tenda AC7 routers and implement enhanced monitoring of outbound network traffic for signs of compromise.

Tenda AC7 CVE-2026-51845

EUVD-2026-38051 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-06-19 cve@mitre.org

GHSA-m32v-ppvw-wwc8

Buffer Overflow Stack Overflow Tenda Ac7 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Web-reachable /goform endpoint with no auth (AV:N, PR:N, UI:N); single oversized POST parameter triggers stack overflow (AC:L) yielding root code execution (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 19:08 vuln.today

CVSS changed

Jun 22, 2026 - 18:23 NVD

9.8 (CRITICAL)

CVE Published

Jun 19, 2026 - 17:16 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the mac parameter.

AnalysisAI

Stack buffer overflow in Tenda AC7 router firmware v15.03.06.44 allows remote unauthenticated attackers to corrupt memory via the mac parameter in the /goform/AdvSetMacMtuWan web interface endpoint. The flaw carries a CVSS 9.8 critical rating with network attack vector and no authentication required, though no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV. Tenda SOHO routers in this family have a well-documented history of similar /goform/* stack overflows being weaponized for botnet recruitment.

Technical ContextAI

The Tenda AC7 is a consumer-grade dual-band Wi-Fi router whose web management interface is served by a httpd binary handling /goform/* CGI-style endpoints. The CWE-121 (stack-based buffer overflow) root cause is the classic pattern seen across Tenda's MIPS firmware family: user-controlled HTTP parameters (here, the mac value posted to /goform/AdvSetMacMtuWan, which configures WAN MAC address spoofing and MTU) are copied into a fixed-size stack buffer without bounds checking, typically via strcpy/sprintf, allowing return-address overwrite. The single affected build identified is firmware v15.03.06.44; no formal CPE entry was supplied with the advisory.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published a fixed firmware build or PSIRT advisory in the supplied data, and the only reference (https://www.kdev.site/cve-request_007/) is a researcher CVE-request page. As compensating controls, disable WAN-side remote management on the AC7 web UI so /goform/AdvSetMacMtuWan is only reachable from the LAN (side effect: administrators must be on the local network to change settings); place the router's LAN management interface on an isolated VLAN or restrict it to a single admin host via ACL so untrusted LAN clients (IoT, guest Wi-Fi, compromised endpoints) cannot reach /goform/* (side effect: breaks app-based management from guest SSIDs); if feasible, replace the device with a supported model or third-party firmware (OpenWrt) where the affected SDK code path does not exist (side effect: voids warranty and loses Tenda-specific features). Monitor Tenda's support site (tendacn.com) for a firmware update superseding 15.03.06.44.