Stack Buffer Overflow in Tenda AC7 Router

Executive Summary

CVE-2026-51846 is a stack buffer overflow vulnerability found in Tenda AC7 routers running firmware version V15.03.06.44 and possibly earlier versions.

The vulnerability exists in the /goform/AdvSetMacMtuWan route, specifically in the handling of the wanSpeed parameter.

The issue arises because the check_param_changed method uses the strcpy function to copy user input into a stack buffer without checking the size, allowing attackers to provide input that exceeds the buffer's capacity.

This can lead to a stack overflow, which attackers can exploit to execute arbitrary code remotely or cause denial-of-service conditions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to remotely execute arbitrary code on the affected Tenda AC7 router.

Remote arbitrary code execution could enable attackers to take control of the device, potentially leading to unauthorized access to the network.

Additionally, exploitation could cause denial-of-service attacks, disrupting network availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending a crafted POST request to the /goform/AdvSetMacMtuWan endpoint with an excessively long wanSpeed parameter value. Monitoring for such unusual or malformed POST requests targeting this route may help identify exploitation attempts.

A possible detection command could be using curl to test the endpoint with a long wanSpeed value, for example:

• curl -X POST http://[router_ip]/goform/AdvSetMacMtuWan -d "wanSpeed=$(python3 -c 'print("A"*500)')"

Network intrusion detection systems (NIDS) can be configured to alert on POST requests to /goform/AdvSetMacMtuWan with unusually large wanSpeed parameters.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable endpoint /goform/AdvSetMacMtuWan by limiting management access to trusted networks or IP addresses.

Additionally, monitoring and blocking suspicious POST requests with abnormally long wanSpeed parameter values can help prevent exploitation.

If possible, update the router firmware to a version where this vulnerability is patched or contact the vendor for a security update.

Useful 0 Not Useful 0