EUVD-2026-38051
GHSA-m32v-ppvw-wwc8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Web-reachable /goform endpoint with no auth (AV:N, PR:N, UI:N); single oversized POST parameter triggers stack overflow (AC:L) yielding root code execution (C/I/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the mac parameter.
AnalysisAI
Stack buffer overflow in Tenda AC7 router firmware v15.03.06.44 allows remote unauthenticated attackers to corrupt memory via the mac parameter in the /goform/AdvSetMacMtuWan web interface endpoint. The flaw carries a CVSS 9.8 critical rating with network attack vector and no authentication required, though no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to send an HTTP request to the router's web management interface on the /goform/AdvSetMacMtuWan endpoint with a malicious mac parameter; CVSS PR:N/UI:N indicates no authentication or user interaction is required to reach the vulnerable parser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and worth disentangling. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the same LAN - or reaching the router through an enabled remote-management interface - sends a single crafted HTTP POST to /goform/AdvSetMacMtuWan with an oversized mac parameter, overwriting the saved return address on the httpd stack and redirecting execution to attacker-controlled shellcode or a ROP gadget chain to drop a MIPS-architecture payload. No public exploit code has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) describes one-shot remote unauthenticated code execution, and historically near-identical Tenda /goform/* overflows have been absorbed into Mirai-derived botnets within weeks of disclosure. |
| Remediation | No vendor-released patch identified at time of analysis - Tenda has not published a fixed firmware build or PSIRT advisory in the supplied data, and the only reference (https://www.kdev.site/cve-request_007/) is a researcher CVE-request page. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all Tenda AC7 units currently deployed; immediately implement network isolation and disable remote administrative access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Stack buffer overflow in Tenda AC7 router firmware v15.03.06.44 allows remote attackers to corrupt memory through the wa
Stack buffer overflow in Tenda AC7 router firmware v15.03.06.44 allows remote attackers to corrupt memory via an oversiz
Remote code execution in Tenda AC7 routers (firmware v15.03.06.44) is possible via a stack buffer overflow in the wanSpe
Share
External POC / Exploit Code
Leaving vuln.today