Executive brief
The Tenda AC7 router, a device used to provide home and small office internet connectivity, contains a security flaw in its web management interface. An attacker can exploit this vulnerability by sending a specially crafted request to the router's configuration settings. If successful, this could allow the attacker to crash the device, causing an internet outage, or potentially take full control of the router to monitor network traffic.
Technical details
A stack-based buffer overflow exists in the Tenda AC7 router firmware version V15.03.06.44. The vulnerability is located within the 'check_param_changed' method, which processes the 'mac' parameter from the '/goform/AdvSetMacMtuWan' HTTP POST interface. The application uses the unsafe 'strcpy' function to copy user-supplied input into a fixed-size stack buffer without performing length validation. A remote attacker can exploit this by sending an oversized string in the 'mac' parameter, leading to memory corruption. This can result in a denial-of-service (DoS) condition or arbitrary code execution (RCE) with the privileges of the web server.
Affected products
- Tenda AC7 Router V15.03.06.44
Timeline
- 2026-04-30: disclosed: Initial discovery and report by KDEV
- 2026-06-19: advisory: CVE published to NVD