PT-2026-6189 · Tenda · Tenda Ac7

Kazuma Matsumoto · Published 2026-02-03 · Updated 2026-02-10 · CVE-2026-24426

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda AC7 firmware versions prior to V03.03.03.01 cn

Description The software contains an improper output encoding issue in the web management interface. User-supplied input is reflected in HTTP responses without sufficient escaping, potentially allowing the injection of arbitrary HTML or JavaScript into a user's browser. The user-supplied input is not properly sanitized before being included in the HTTP response.

Recommendations Update to a firmware version newer than V03.03.03.01 cn.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-24426

Affected Products

Tenda Ac7

References · 6

• https://osv.dev/vulnerability/CVE-2026-24426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24426 · Security Note
• https://vulncheck.com/advisories/tenda-ac7-reflected-xss-via-web-interface-output-encoding · Note
• https://tendacn.com/product/AC7 · Note
• https://t.me/cveNotify/151552 · Telegram Post
• https://twitter.com/CVEnew/status/2018778332649672788 · Twitter Post