Description
A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Handler. Executing a manipulation of the argument Time can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
Published: 2026-03-27
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via stack-based buffer overflow
Action: Patch Immediately
AI Analysis

Impact

A stack-based buffer overflow exists in the /goform/SetSysTimeCfg POST handler on Tenda AC7 routers. By sending a crafted Time field, an attacker can overwrite the stack, potentially leading to arbitrary code execution or denial of service. The flaw is cataloged as CWE-119 and CWE-121, indicating a memory corruption vulnerability that can compromise router integrity.

Affected Systems

The vulnerability impacts Tenda AC7 devices running firmware version 15.03.06.44. The affected component is the SetSysTime configuration endpoint exposed over the router’s web interface. Any AC7 unit with this firmware is considered vulnerable until a patched release is applied.

Risk and Exploitability

The CVSS score of 8.7 classifies this issue as high severity. Exploitation is possible remotely without authentication, and publicly available exploits have already been disclosed. Although EPSS data is missing and the vulnerability is not yet listed in KEV, the combination of remote access, lack of authentication, and memory corruption creates a significant threat landscape for exposed routers.

Generated by OpenCVE AI on March 27, 2026 at 22:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the AC7 firmware to the latest Tenda release that addresses the SetSysTimeCfg memory corruption issue
  • If no patch is available, block or limit access to the /goform/SetSysTimeCfg endpoint using firewall rules or ACLs
  • Restrict the router’s web management interface to the local network or enforce VPN access
  • Monitor logs for anomalous POST requests to /goform/SetSysTimeCfg and investigate any suspicious activity

Generated by OpenCVE AI on March 27, 2026 at 22:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 30 Mar 2026 19:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
CPEs cpe:2.3:h:tenda:ac7:1.0:*:*:*:*:*:*:*
cpe:2.3:o:tenda:ac7_firmware:15.03.06.44:*:*:*:*:*:*:*

Mon, 30 Mar 2026 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Tenda ac7
Vendors & Products Tenda ac7

Fri, 27 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Handler. Executing a manipulation of the argument Time can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
Title Tenda AC7 POST Request SetSysTimeCfg fromSetSysTime memory corruption
First Time appeared Tenda
Tenda ac7 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:ac7_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda ac7 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Ac7 Ac7 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-27T19:52:50.992Z

Reserved: 2026-03-27T08:56:49.008Z

Link: CVE-2026-4974

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-03-27T20:16:38.473

Modified: 2026-03-30T19:33:20.427

Link: CVE-2026-4974

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-30T07:00:35Z

Weaknesses