External risk intelligence

Tenda AC7 Stack Buffer Overflow in MacMtuWan Interface

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-51844

The vulnerability exists in a home router interface designed for internet connectivity management. As a networking device specifically intended to act as an internet gateway, these management interfaces and configuration forms are frequently exposed to the network to facilitate device administration, making them inherently public-facing by design in standard deployment scenarios.

Buffer Overflow

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Tenda network devices, specifically within an interface used for managing internet connectivity settings. This flaw could allow an attacker to remotely execute arbitrary code, potentially leading to a compromise of the device and any network it protects. The main concern is confirming relevance and exposure.

Device management flaw allows remote code execution.
Critical flaw impacts internet connectivity devices.
Verify if this device type is in your environment.

Attack Path

How an attacker could exploit the issue

A remote attacker could exploit this vulnerability by sending a specially crafted request to the affected device's network interface. This request would target a specific configuration feature, leading to a buffer overflow that could allow an attacker to gain control or disrupt the device's operation.

No authentication needed to access.
Triggered by a network request to AdvSetMacMtuWan.
Enables unauthorized access or disruption.

Live Threat

Current exploitation, exposure, and threat context

In the Tenda AC7 router, a stack buffer overflow in the /goform/AdvSetMacMtuWan interface could allow an unauthenticated attacker to impact the device's service behavior when interacting with the cloneType parameter. This vulnerability does not appear to directly expose user data or PII.

Router service integrity.
Unauthenticated network interaction.
Disruption of network connectivity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability in the Tenda AC7 router's MacMtuWan interface is likely to be the responsibility of the network infrastructure or security teams who manage edge devices. The first critical step is to identify all deployed Tenda AC7 routers, determine their network exposure, confirm business criticality, and then assign an accountable owner for remediation planning.

Network/Security team should own.
Verify router exposure and criticality.
Plan vendor coordination for fix.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Tenda AC7 and why does it have this CVE?

The Tenda AC7 is a wireless router commonly used to manage home or small office internet connectivity. This vulnerability exists because the software component responsible for handling network settings, specifically the interface that manages MAC address cloning and MTU configuration, contains a security flaw that can be triggered through its management functions.

What does CWE-121 mean for CVE-2026-51844?

CWE-121 refers to a stack-based buffer overflow. In plain English, this means the software does not properly check the amount of data it receives before saving it to a temporary memory space called the stack. Because the system fails to limit this input, an attacker can intentionally send too much data to the device, potentially overwriting adjacent memory and causing the system to run unintended instructions.

How is this Tenda router vulnerability triggered?

The vulnerability is triggered when an attacker sends a specially crafted network request to the /goform/AdvSetMacMtuWan interface. Specifically, the flaw resides in how the system processes the cloneType parameter. It is important to note that this requires no authentication; a simple network request targeting this specific configuration form is sufficient to initiate the faulty process.

Is my device at risk according to Halo Surface Signal?

Halo Surface Signal identifies that because the Tenda AC7 is an internet gateway device, its management interfaces are often exposed to the network by design. Since these forms are intended to facilitate administration, they are frequently reachable from the internet. If your device is configured with this management interface accessible, it is categorized as external and warrants immediate attention.

What should I do if I use Tenda AC7 routers?

Your first priority is to locate all Tenda AC7 units within your network environment. Once identified, evaluate whether these devices are reachable from the internet or restricted to internal traffic. Document their location and function, then consult the manufacturer's official support channels for guidance on updates or configuration changes to mitigate the risk while you plan for long-term resolution.

References

www.kdev.site/cve-request_006/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.