CVE-2026-4974: Tenda AC7 POST Request SetSysTimeCfg fromSetSysTime memory corruption
A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Handler. Executing a manipulation of the argument Time can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4974?
CVE-2026-4974 has a high severity rating due to its potential for memory corruption and exploitation.
How do I fix CVE-2026-4974?
To fix CVE-2026-4974, users should update their Tenda AC7 firmware to a version that addresses this vulnerability.
What specific component of Tenda AC7 is affected by CVE-2026-4974?
CVE-2026-4974 affects the POST Request Handler function fromSetSysTime in the Tenda AC7 firmware.
Can CVE-2026-4974 lead to remote code execution?
Yes, exploiting CVE-2026-4974 could potentially allow an attacker to achieve remote code execution on the device.
Is it safe to use Tenda AC7 with the CVE-2026-4974 vulnerability?
Using Tenda AC7 with CVE-2026-4974 poses security risks, and it is advisable to apply the necessary firmware updates promptly.