PT-2026-28699 · Tenda · Tenda Ac7

Wxhwxhwxh_Mie · Published 2026-03-27 · Updated 2026-03-28 · CVE-2026-4974

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC7 version 15.03.06.44

Description A stack-based buffer overflow can occur in the fromSetSysTime function within the /goform/SetSysTimeCfg file, specifically through manipulation of the Time argument via a POST request. This allows for remote exploitation. The exploit has been published.

Recommendations Update the firmware to address this vulnerability.

Exploit

Fix

Stack Overflow

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-787

CWE-119

Related Identifiers

CVE-2026-4974

Affected Products

Tenda Ac7

References · 8

• 🔥 https://lavender-bicycle-a5a.notion.site/Tenda-AC7-fromSetSysTime-32153a41781f801c95b0f8a53eaa9a1f?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4974 · Security Note
• https://tenda.com.cn · Note
• https://vuldb.com/?id.353861 · Note
• https://vuldb.com/?submit.778207 · Note
• https://vuldb.com/?ctiid.353861 · Note
• https://twitter.com/CVEnew/status/2037719407036907843 · Twitter Post
• https://twitter.com/CveFindCom/status/2037631580835901890 · Twitter Post