EUVD-2026-38052
GHSA-j57g-r926-cwvq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated POST to a network-reachable goform handler triggers a stack overflow with no user interaction, yielding root-level RCE on the router with full CIA impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
In Tenda AC7 v15.03.06.44, the wanSpeed parameter of the route /goform/AdvSetMacMtuWan has a stack buffer overflow vulnerability that can lead to remote arbitrary code execution.
AnalysisAI
Remote code execution in Tenda AC7 routers (firmware v15.03.06.44) is possible via a stack buffer overflow in the wanSpeed parameter of the /goform/AdvSetMacMtuWan endpoint. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network-based exploitation with full confidentiality, integrity, and availability impact, though no public exploit identified at time of analysis and the device is not listed in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to reach the router's HTTP administration interface and submit a POST request to /goform/AdvSetMacMtuWan with an attacker-controlled wanSpeed parameter; per CVSS PR:N/UI:N no authentication or user interaction is required to reach the vulnerable code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Raw signals point to high risk: CVSS 9.8 with AV:N/AC:L/PR:N/UI:N and a stack overflow yielding RCE on a perimeter device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network reachability to the router's HTTP admin interface - typically an attacker on the same LAN or Wi-Fi, or a remote attacker if WAN management is exposed - sends a crafted POST request to /goform/AdvSetMacMtuWan with an oversized wanSpeed value, overflowing a stack buffer in the httpd process to overwrite the saved return address. Successful exploitation yields arbitrary code execution as root on the router, enabling traffic interception, DNS hijacking, or pivoting into the internal network. … |
| Remediation | No vendor-released patch identified at time of analysis - Tenda has not published an advisory in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct immediate inventory of all Tenda AC7 devices, confirm firmware version 15.03.06.44, and document network topology and access paths. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Stack buffer overflow in Tenda AC7 router firmware v15.03.06.44 allows remote attackers to corrupt memory through the wa
Stack buffer overflow in Tenda AC7 router firmware v15.03.06.44 allows remote attackers to corrupt memory via an oversiz
Stack buffer overflow in Tenda AC7 router firmware v15.03.06.44 allows remote unauthenticated attackers to corrupt memor
Share
External POC / Exploit Code
Leaving vuln.today