CVE-2026-24426: Tenda AC7 Reflected XSS via Web Interface Output Encoding
Published Feb 3, 2026
·Updated
Shenzhen Tenda AC7 firmware version V03.03.03.01cn and prior contain an improper output encoding vulnerability in the web management interface. User-supplied input is reflected in HTTP responses without adequate escaping, allowing injection of arbitrary HTML or JavaScript in a victim’s browser context.
Affected Software
3 affected components
Tenda AC7<=V03.03.03.01_cn
All of the following
Tenda AC7 firmware<=03.03.03.01
Tenda AC7
Event History
Feb 3, 2026
CVE Published
via MITRE·07:09 PM
Data Sourced
via MITRE·07:09 PM
DescriptionWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeaknessAffected Software
Jun 19, 58090
Event
via FIRST·07:24 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-24426?
CVE-2026-24426 is classified as a medium severity reflected XSS vulnerability.
2
How do I fix CVE-2026-24426?
To fix CVE-2026-24426, update the Tenda AC7 firmware to a version newer than V03.03.03.01_cn.
3
What type of vulnerability is CVE-2026-24426?
CVE-2026-24426 is a reflected cross-site scripting (XSS) vulnerability.
4
What can an attacker do with CVE-2026-24426?
An attacker can exploit CVE-2026-24426 to inject malicious scripts into the web management interface.
5
Which versions of Tenda AC7 are affected by CVE-2026-24426?
Tenda AC7 firmware versions up to and including V03.03.03.01_cn are affected by CVE-2026-24426.