Skip to content
COOEY

FAIL › dossier

ac7 firmware

PRODUCT

· dossier confidence 50%

Tenda AC7 firmware is critically vulnerable to multiple simultaneous stack buffer overflows in the AdvSetMacMtuWan interface, allowing remote arbitrary code execution. The concentration of four critical CVEs in a single version highlights a severe lack of input validation and secure coding practices.

Failure events
4
Zero-days
1
RCEs
1
On KEV
0
Critical
4
Worst shame
50
PROFILE
CategoryNetworking HardwareWhat they doTenda AC7 is a wireless router manufactured by Tenda Technology.
SECURITY POSTURE

The Tenda AC7 firmware exhibits a severe and concentrated vulnerability pattern, with four critical CVEs discovered simultaneously in a single firmware version, indicating a systemic failure in input validation and secure coding practices.

Notable failures
  • CVE-2026-51846: Critical RCE0day via stack buffer overflow in wanSpeed parameter
  • CVE-2026-51843: Critical stack buffer overflow via wanMTU parameter
  • CVE-2026-51845: Critical stack buffer overflow via mac parameter
  • CVE-2026-51844: Critical stack buffer overflow via cloneType parameter
Patterns: Repeated unpatched stack buffer overflows in the same firmware interface; Multiple critical vulnerabilities discovered simultaneously in a single firmware release
FAILURE HISTORY · 4
DATEEVENTSEVSUMMARY
2026-06-19 CVE-2026-51846 critical In Tenda AC7 v15.03.06.44, the wanSpeed parameter of the route /goform/AdvSetMacMtuWan has a stack buffer overflow vulnerability that can lead to remote arbitrary code execution.
2026-06-19 CVE-2026-51843 critical Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the wanMTU parameter.
2026-06-19 CVE-2026-51845 critical Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the mac parameter.
2026-06-19 CVE-2026-51844 critical Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the cloneType parameter.
Open questions: What is the exact release date of firmware v15.03.06.44? · Has Tenda issued a patch for these vulnerabilities? · What is the current patch level for the Tenda AC7?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-08-18 04:05:41.971196+00:00