Executive brief
The Tenda AC7 router, a device used to provide wireless internet access, contains a security flaw in its web management interface. An attacker can exploit this flaw by sending a specially crafted request to the router's settings page. If successful, this could allow the attacker to crash the device or take complete control over it, potentially leading to the interception of network traffic or unauthorized access to the home or office network.
Technical details
A stack-based buffer overflow exists in the Tenda AC7 router firmware version v15.03.06.44. The vulnerability is located within the 'check_param_changed' function, which processes the 'wanMTU' parameter from the '/goform/AdvSetMacMtuWan' interface. The root cause is the use of the unsafe 'strcpy' function to copy user-supplied input into a fixed-size stack buffer without length validation. A remote attacker can exploit this by sending a crafted POST request with an overly long 'wanMTU' string, leading to arbitrary code execution or a denial-of-service (DoS) condition. Based on the PoC, authentication may be required (indicated by a password cookie), but the impact remains critical.
Affected products
- Tenda AC7 v15.03.06.44
Timeline
- 2026-04-30: disclosed: Initial discovery and PoC published by KDEV
- 2026-06-19: advisory: CVE published by NVD/MITRE