CVE-2026-24426 is an XSS vulnerability (CWE-79) in Shenzhen Tenda Technology Co., Ltd.'s Tenda AC7 router firmware version V03.03.03.01_cn and prior. The issue arises from improper output encoding in the web management interface, where user input is reflected in HTTP responses without proper escaping. This allows attackers to inject arbitrary HTML or JavaScript code that executes in the victim's browser session when interacting with the router's web interface. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity), with network attack vector, low attack complexity, no privileges or user interaction required, and limited scope and impact confined to the web interface context. No patch or official fix has been published as of the data provided.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the router's web management interface on a victim's browser. This may lead to session hijacking, unauthorized actions within the router interface, or other client-side impacts. However, the vulnerability does not grant direct control over the device or network and requires user interaction to trigger the malicious payload. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit access to the router's web management interface to trusted networks and users only. Avoid interacting with suspicious links or inputs that could trigger the vulnerability. Monitor vendor channels for updates or firmware patches addressing this issue.