What is the CVSS score of CVE-2026-51846?

CVE-2026-51846 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Tenda AC7 are affected by CVE-2026-51846?

Tenda AC7 routers running firmware v15.03.06.44 are vulnerable to unauthenticated remote code execution accessible over the network, enabling complete device compromise and potential lateral network…

How to fix or mitigate CVE-2026-51846?

Within 24 hours: Conduct immediate inventory of all Tenda AC7 devices, confirm firmware version 15.03.06.44, and document network topology and access paths. Within 7 days: Implement network segmentation isolating affected routers from untrusted segments using strict ACLs, disable WAN-accessible management services, and initiate replacement procurement. Within 30 days: Replace affected devices with units running current firmware versions or sustain compensating controls if replacement timeline extends beyond 30 days.

Tenda AC7 CVE-2026-51846

EUVD-2026-38052 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-06-19 cve@mitre.org

GHSA-j57g-r926-cwvq

Stack Overflow RCE Buffer Overflow Tenda Ac7 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated POST to a network-reachable goform handler triggers a stack overflow with no user interaction, yielding root-level RCE on the router with full CIA impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 18:23 vuln.today

CVSS changed

Jun 22, 2026 - 18:23 NVD

9.8 (CRITICAL)

CVE Published

Jun 19, 2026 - 17:16 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In Tenda AC7 v15.03.06.44, the wanSpeed parameter of the route /goform/AdvSetMacMtuWan has a stack buffer overflow vulnerability that can lead to remote arbitrary code execution.

AnalysisAI

Remote code execution in Tenda AC7 routers (firmware v15.03.06.44) is possible via a stack buffer overflow in the wanSpeed parameter of the /goform/AdvSetMacMtuWan endpoint. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network-based exploitation with full confidentiality, integrity, and availability impact, though no public exploit identified at time of analysis and the device is not listed in CISA KEV.

Technical ContextAI

The Tenda AC7 is a SOHO-class AC1200 wireless router whose web management interface exposes goform/* CGI-style endpoints commonly implemented in the httpd binary on the device. CWE-121 (Stack-based Buffer Overflow) indicates that the wanSpeed parameter is copied into a fixed-size stack buffer without bounds validation, overwriting the saved return address or function pointers - a recurring pattern across Tenda's MIPS-based firmware family that has produced dozens of analogous CVEs in /goform/* handlers. Exploitation typically yields code execution in the context of the web server process, which on these devices runs as root.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published an advisory in the provided data. Until a firmware update is released, restrict access to the router's web management interface by disabling remote (WAN-side) administration in the router settings, segmenting management access to a trusted VLAN, and ensuring the LAN-side admin password is strong to limit who can reach /goform/AdvSetMacMtuWan; note that disabling remote admin prevents legitimate off-LAN management. Monitor Tenda's support portal for an updated firmware build superseding 15.03.06.44, and consider replacing end-of-support AC7 hardware if no fix materializes, since this product line has a long history of unpatched goform vulnerabilities.