Tenda AC7 CVE-2026-51845

The attacker must be able to send an HTTP request to the router's web management interface on the /goform/AdvSetMacMtuWan endpoint with a malicious mac parameter; CVSS PR:N/UI:N indicates no authentication or user interaction is required to reach the vulnerable parser. The practical limiting factor is network reachability of the admin UI: by default it is bound to the LAN, so remote exploitation requires the user to have enabled WAN-side remote management or the attacker to already have a foothold on the LAN (compromised endpoint, hostile Wi-Fi client, or chained DNS-rebinding from a browser). The vulnerability is specific to Tenda AC7 firmware build 15.03.06.44 - other firmware revisions or hardware versions are not confirmed affected from the available data.

Signals are mixed and worth disentangling. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) describes a remote, unauthenticated, low-complexity memory-corruption bug with full impact - on paper a top-priority issue. However, no EPSS score, KEV listing, SSVC decision, or public PoC was supplied, and the only reference is a single third-party request page rather than a vendor advisory, so real-world exploitation evidence is currently absent. Mitigating realities: the admin endpoint is normally reachable only from the LAN side unless remote management is enabled, so AV:N is technically accurate but practically gated by network exposure - a factor the CVSS score does not capture. Given Tenda routers' track record of /goform/* overflows being absorbed into Mirai-class botnets once a working exploit is published, the latent risk is high even though present-day exploitation evidence is thin.

An attacker on the same LAN - or reaching the router through an enabled remote-management interface - sends a single crafted HTTP POST to /goform/AdvSetMacMtuWan with an oversized mac parameter, overwriting the saved return address on the httpd stack and redirecting execution to attacker-controlled shellcode or a ROP gadget chain to drop a MIPS-architecture payload. No public exploit code has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) describes one-shot remote unauthenticated code execution, and historically near-identical Tenda /goform/* overflows have been absorbed into Mirai-derived botnets within weeks of disclosure.