This vulnerability affects Shenzhen Tenda AC7 routers running firmware version V03.03.03.01_cn and prior. The web management interface responses include administrative credentials, such as router or admin panel passwords, in plaintext within configuration response bodies. Additionally, the HTTP responses lack Cache-Control directives, which may cause browsers to cache these sensitive pages. This increases the risk of credential disclosure to an attacker with access to the client device or browser data. The issue is categorized as CWE-201 (Insertion of Sensitive Information Into Sent Data). The CVSS 4.0 vector indicates local attack vector with low attack complexity and no user interaction required, but privileges are needed to exploit. The vulnerability is published and assigned CVE-2026-24427. No patch or official fix has been documented.

Exposure of administrative credentials in plaintext within web management responses can lead to unauthorized access if an attacker obtains access to the client system or browser cache. The lack of Cache-Control headers exacerbates this risk by allowing sensitive pages to be stored locally in browser caches. This could compromise router administration and network security. However, exploitation requires local access and some privileges, limiting the attack surface. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict local access to trusted individuals and clear browser caches after accessing the router management interface. Avoid using shared or public devices to manage the router. Monitor vendor communications for updates regarding patches or firmware upgrades addressing this issue.