CVE-2026-51844: Tenda AC7 Buffer Overflow Vulnerability

CVE-2026-51844 Overview

CVE-2026-51844 is a stack-based buffer overflow in the Tenda AC7 router running firmware v15.03.06.44. The flaw resides in the /goform/AdvSetMacMtuWan web interface handler and is triggered through the cloneType parameter. An unauthenticated attacker reachable over the network can send a crafted HTTP request to overflow a fixed-size stack buffer in the router's httpd process. Successful exploitation leads to memory corruption and potential arbitrary code execution on the device with the privileges of the web server. The weakness is classified as [CWE-121] Stack-based Buffer Overflow.

Critical Impact
An unauthenticated remote attacker can corrupt stack memory on the Tenda AC7 router and gain full control of the device.

Affected Products

Tenda AC7 router firmware v15.03.06.44
/goform/AdvSetMacMtuWan HTTP interface
cloneType request parameter

Discovery Timeline

2026-06-19 - CVE-2026-51844 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-51844

Vulnerability Analysis

The Tenda AC7 web management daemon exposes the /goform/AdvSetMacMtuWan endpoint to configure the WAN MAC address and MTU. The handler reads the cloneType parameter from the incoming HTTP request and copies it into a fixed-size buffer on the stack without enforcing length validation. When an attacker submits an oversized cloneType value, the copy operation writes past the buffer boundary and overwrites adjacent stack data, including the saved return address.

Because the request is processed before authentication checks complete on this endpoint, no credentials are required. The attack is network-reachable, requires no user interaction, and impacts confidentiality, integrity, and availability of the router. According to EPSS data published on 2026-06-25, the exploitation probability is 0.363% (percentile 28.18).

Root Cause

The root cause is missing bounds checking on attacker-controlled input. The cloneType parameter value is copied into a stack buffer using an unsafe string operation, with no length validation against the destination buffer size. This is a textbook [CWE-121] Stack-based Buffer Overflow.

Attack Vector

The attack vector is network-based. An attacker sends a single HTTP POST request to /goform/AdvSetMacMtuWan containing an oversized cloneType value. On devices exposing the management interface to the WAN, exploitation is possible directly from the internet. On LAN-only deployments, an attacker on the local network or one who has already compromised a connected host can reach the endpoint. See the KDev CVE Request #006 advisory for technical details of the request and parameter handling.

Detection Methods for CVE-2026-51844

Indicators of Compromise

HTTP POST requests to /goform/AdvSetMacMtuWan containing abnormally long cloneType values
Unexpected restarts or crashes of the Tenda AC7 httpd process
Outbound connections from the router to unknown command-and-control infrastructure following exploitation
New or modified configuration entries on the router not initiated by an administrator

Detection Strategies

Inspect HTTP traffic to router management interfaces for requests targeting /goform/AdvSetMacMtuWan with parameter values exceeding expected lengths
Alert on repeated HTTP 5xx responses or connection resets from the router web interface, which can indicate crash-on-overflow conditions
Monitor for management-plane traffic originating from untrusted network segments

Monitoring Recommendations

Log and review all administrative HTTP requests reaching consumer router devices on the network
Track router firmware version and configuration drift across managed devices
Capture flow telemetry for traffic to and from router IPs and correlate with known-good administrative sources

How to Mitigate CVE-2026-51844

Immediate Actions Required

Disable remote (WAN-side) administration on the Tenda AC7 immediately
Restrict access to the LAN-side web management interface to a dedicated administrative host or VLAN
Audit the router for unauthorized configuration changes, DNS settings, and firmware modifications

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-51844. Monitor the KDev CVE Request #006 advisory and the Tenda support portal for firmware updates superseding v15.03.06.44. Apply any released firmware update as soon as it becomes available.

Workarounds

Block external access to TCP ports used by the router web interface at the upstream firewall
Place affected routers behind a network segment that restricts management access to known administrator IP addresses
Replace the device with a supported model if a vendor fix is not released in a reasonable timeframe

bash

# Example: block inbound access to the router management interface using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <router-ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router-ip> --dport 443 -j DROP