CVE-2026-24441 is a vulnerability in Shenzhen Tenda AC7 router firmware (version V03.03.03.01_cn and prior) where account credentials are exposed in plaintext within HTTP responses. This cleartext transmission of sensitive authentication data enables an on-path attacker to capture credentials during network communication. The vulnerability is identified as CWE-319 and has a high CVSS 4.0 base score of 8.2, reflecting network attack vector with high impact on confidentiality. No vendor patch or official remediation guidance is currently available.

An attacker with the ability to intercept network traffic between the user and the affected device can obtain sensitive account credentials in cleartext. This compromises the confidentiality of authentication material, potentially allowing unauthorized access to the device or network. The vulnerability does not require user interaction or privileges and affects all users of the specified firmware versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using unencrypted HTTP management interfaces on the affected firmware and restrict network access to the device's management interface to trusted networks only.