Tenda AC7 CVE-2026-51846

The attacker must be able to reach the router's HTTP administration interface and submit a POST request to /goform/AdvSetMacMtuWan with an attacker-controlled wanSpeed parameter; per CVSS PR:N/UI:N no authentication or user interaction is required to reach the vulnerable code path. The realistic limiter is network reachability: the admin interface is LAN-only by default, so remote exploitation across the internet requires the operator to have enabled WAN-side remote management (or the attacker to already be on the LAN/Wi-Fi). Exploitation is constrained to Tenda AC7 hardware running firmware v15.03.06.44.

Raw signals point to high risk: CVSS 9.8 with AV:N/AC:L/PR:N/UI:N and a stack overflow yielding RCE on a perimeter device. However, EPSS and KEV status were not supplied in the input, so probabilistic and confirmed-exploitation data are unknown. In practice the network vector typically means LAN-side exploitation unless the WAN management interface is exposed - a common Tenda misconfiguration but not the default. The only reference is a third-party research URL with no vendor advisory, no patch version, and no public PoC identified at time of analysis, which suggests this is a researcher-disclosed flaw rather than a campaign-driven threat. Treat as high priority for affected fleets but recognize that real-world impact depends heavily on whether the admin interface is reachable from untrusted networks.

An attacker with network reachability to the router's HTTP admin interface - typically an attacker on the same LAN or Wi-Fi, or a remote attacker if WAN management is exposed - sends a crafted POST request to /goform/AdvSetMacMtuWan with an oversized wanSpeed value, overflowing a stack buffer in the httpd process to overwrite the saved return address. Successful exploitation yields arbitrary code execution as root on the router, enabling traffic interception, DNS hijacking, or pivoting into the internal network. No public exploit identified at time of analysis, but the bug class is well-understood and trivially fuzzable.