Executive brief
A vulnerability exists in the Tenda AC7 router, a device used to provide wireless internet access. An attacker can send a specially crafted request to the router's management interface to crash the device or potentially take full control of it. This could lead to a total loss of internet connectivity or allow an unauthorized user to monitor network traffic.
Technical details
A stack-based buffer overflow exists in the Tenda AC7 router firmware version v15.03.06.44. The vulnerability is located in the 'check_param_changed' method, which processes the 'cloneType' parameter from the '/goform/AdvSetMacMtuWan' interface. The application uses the unsafe 'strcpy' function to copy user-supplied input into a fixed-size stack buffer without proper bounds checking. A remote attacker can exploit this by sending a crafted POST request to overwrite the stack, potentially leading to denial-of-service (DoS) or arbitrary code execution (RCE). While the advisory does not explicitly state authentication requirements, the PoC includes a password cookie, suggesting administrative access may be required depending on the device configuration.
Affected products
- Tenda AC7 v15.03.06.44
Timeline
- 2026-04-30: disclosed: Initial discovery and report by KDEV
- 2026-06-19: advisory: CVE published to NVD dataset