CVE-2026-51846 is a stack buffer overflow vulnerability in Tenda AC7 firmware version 15.03.06.44. The issue exists in the handling of the wanSpeed parameter on the /goform/AdvSetMacMtuWan route, allowing an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation can lead to arbitrary code execution on the affected device, compromising system control. The vulnerability is identified as CWE-121 (Stack-based Buffer Overflow) and has a critical CVSS 3.1 base score of 9.8.

Exploitation of this vulnerability allows remote attackers to execute arbitrary code on the affected Tenda AC7 device without any authentication. This can lead to full compromise of the device, including unauthorized access, data theft, disruption of network services, and potential use of the device in further attacks. The vulnerability affects confidentiality, integrity, and availability severely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor Tenda's official channels for updates and apply any released patches promptly once available. Until then, restricting external access to the device's management interfaces may reduce exposure.