EUVD-2026-38050
GHSA-g533-f37w-h6w3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Pre-auth /goform handler reachable over HTTP with no user interaction; stack overflow yields code execution as root on the device, giving full C/I/A impact within the same scope.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the cloneType parameter.
AnalysisAI
Stack buffer overflow in Tenda AC7 router firmware v15.03.06.44 allows remote attackers to corrupt memory via an oversized cloneType parameter sent to the /goform/AdvSetMacMtuWan web interface endpoint. The CVSS 9.8 vector indicates unauthenticated network exploitation with high impact to confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the router's HTTP management interface on the port where /goform/AdvSetMacMtuWan is served (default LAN web UI, or WAN if 'Remote Web Management' has been enabled by the operator), and the device must be running firmware 15.03.06.44 (other builds not enumerated in the provided data). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N rates this as critical (9.8) and remotely exploitable without authentication or user interaction, which is consistent with the described pre-auth /goform handler reachable over HTTP. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the same network segment as the router (or on the Internet if remote management is enabled) sends a single crafted HTTP POST to /goform/AdvSetMacMtuWan with an overlong cloneType value, smashing the stack of the httpd process and redirecting execution to attacker-controlled shellcode or a ROP chain on the MIPS firmware. Successful exploitation yields code execution as the web daemon (typically root on Tenda firmware), enabling persistent backdooring, DNS hijacking, or use of the device as a botnet node. … |
| Remediation | No vendor-released patch identified at time of analysis - the input contains no Tenda advisory URL, fixed firmware version, or KB article, so administrators should monitor https://www.tendacn.com for an AC7 firmware update superseding 15.03.06.44 and apply it once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Inventory all Tenda AC7 routers running firmware v15.03.06.44 and immediately restrict administrative interface access via firewall rules; block internet-facing access to the /goform/AdvSetMacMtuWan endpoint. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Stack buffer overflow in Tenda AC7 router firmware v15.03.06.44 allows remote attackers to corrupt memory through the wa
Stack buffer overflow in Tenda AC7 router firmware v15.03.06.44 allows remote unauthenticated attackers to corrupt memor
Remote code execution in Tenda AC7 routers (firmware v15.03.06.44) is possible via a stack buffer overflow in the wanSpe
Share
External POC / Exploit Code
Leaving vuln.today