CVE-2026-51844 is a stack buffer overflow (CWE-121) in Tenda AC7 router firmware V15.03.06.44, in the /goform/AdvSetMacMtuWan interface through the cloneType parameter. NVD scores it 9.8 critical. No fixed firmware is named, so check Tenda for an update and keep the admin page off the internet.
What's affected
Tenda AC7 firmware V15.03.06.44, per the CVE record. The reporter's write-up says earlier versions are likely affected too, so do not read that version as the lower bound.
The weak point is the cloneType parameter of the /goform/AdvSetMacMtuWan route. The record names no patched firmware. The same route has three sibling overflow CVEs, CVE-2026-51843 to CVE-2026-51846, each for a different parameter. Check whether the release notes cover all of them.
How to check if you're exposed
Router firmware is not in any package manager. Read the version in the admin page, usually under system status or about, and compare it with V15.03.06.44.
Then check whether the admin interface is reachable from outside your network. From a machine on a different network, try to open the router's public address on the web admin port. If it answers, remote management is on.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find every Tenda AC7 in use, including ones at remote sites and in home offices that connect to your network.
- Turn off remote management and restrict the admin page to the LAN.
- Check the Tenda support page for firmware newer than V15.03.06.44 and install it once it is confirmed to address the overflow.
- Change the admin password and keep guest and IoT devices on a separate network segment.
- Plan to replace the router if no fixed firmware appears and it sits at a network edge.
Why it matters
A stack buffer overflow (CWE-121) happens when a program copies input into a fixed size area on the stack without checking its length. The reporter's description for the related wanMTU case says an unsafe strcpy call copies the value into the buffer with no length check.
On a router, code runs with high privileges and little memory protection, so the record warns of denial of service or remote code execution. The record does not flag it as exploited in the wild and it is not in the CISA Known Exploited Vulnerabilities catalog. The scoring says no privileges are needed, but the reporter's sample request includes a session cookie, so confirm on your own device whether a login is required.
Quick check
Is this the same as the other AC7 overflows?
They share the same route and firmware but affect different parameters, each with its own CVE. Treat them as one exposure and patch once.
Can I fix this myself?
No. The code is in the firmware. Your options are a vendor update, closing remote access, or replacing the device.
Sources
Last reviewed: 19 October 2026.
