External risk intelligence

Tenda AC7 Stack Buffer Overflow in WAN Interface

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-51843

The vulnerability exists in a consumer wireless router (Tenda AC7) within an interface responsible for WAN settings. As a network edge device, its management interfaces and web services are frequently exposed to the public internet or are intended to be accessible from the WAN side by design.

Buffer Overflow

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Tenda AC7 network devices could allow unauthorized access and control due to a buffer overflow issue in the WAN settings interface.

Network devices have a critical security flaw.
This affects internet-facing network equipment.
Confirm relevance and exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the affected device's web interface. This request would target a specific setting related to Wide Area Network (WAN) Maximum Transmission Unit (MTU) values. By overwhelming a buffer with too much data, the attacker could cause a stack buffer overflow, potentially leading to a denial-of-service condition or even allowing for code execution.

Accessible via the internet.
Sending a malicious WAN MTU request.
Leads to system compromise.

Live Threat

Current exploitation, exposure, and threat context

A stack buffer overflow in the /goform/AdvSetMacMtuWan interface could allow an unauthenticated, remote attacker to crash the device or execute arbitrary code when a specially crafted request is sent to the `wanMTU` parameter. This could affect the availability and integrity of the network edge device.

Network availability and device integrity.
Remote unauthenticated requests to `wanMTU`.
Device crash or arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Tenda AC7 vulnerability impacts a consumer wireless router, specifically the /goform/AdvSetMacMtuWan interface. Ownership will likely fall to the team managing network edge devices and their security posture, potentially including infrastructure or a dedicated network security team. The first practical step is to identify all deployed Tenda AC7 devices, determine their exposure, and assess business criticality to prioritize remediation efforts.

Network infrastructure teams own this issue.
Verify Tenda AC7 WAN interface exposure.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Tenda AC7 router?

The Tenda AC7 is a consumer wireless router designed to provide home or small office network connectivity. It manages data traffic between your local devices and the internet service provider, serving as a gateway that facilitates network routing and wireless access.

What does CVE-2026-51843 mean by stack buffer overflow?

This is a memory corruption weakness, categorized as CWE-121. It occurs when a program writes more data to a memory buffer than it can hold. In this specific case, the device fails to properly limit the size of data sent to the WAN MTU setting, allowing an attacker to overwrite nearby memory and potentially take control of the router.

How can an attacker trigger this vulnerability?

An attacker exploits this by sending a specially crafted request to the specific web interface responsible for WAN settings. The bug is triggered via the wanMTU parameter. It is important to note that simply using the router for normal web browsing or local file sharing does not trigger this issue; the malicious input must be specifically directed at that management interface.

Is my Tenda AC7 at risk if it faces the internet?

Yes. Halo Surface Signal notes that because this device is a network edge component, its management interfaces are often exposed to the public internet by design. If your router’s WAN-side management is reachable from outside your network, it is a primary candidate for this type of remote, unauthenticated attack.

What should I do to secure my device?

Start by identifying all Tenda AC7 units in your environment. Check if the administrative interface is exposed to the internet and restrict access if possible. Monitor for manufacturer firmware updates and schedule a maintenance window to apply patches or perform configuration changes to mitigate the risk to your network's integrity.

References

www.kdev.site/cve-request_008/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.