CVE-2026-4974
Published: 27 March 2026
Summary
CVE-2026-4974 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac7 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation and sanitization of the Time argument in the /goform/SetSysTimeCfg POST handler to prevent stack-based buffer overflow exploitation.
Implements memory protections like stack canaries and non-executable memory stacks to block exploitation of the stack-based buffer overflow in fromSetSysTime.
Mandates timely flaw remediation, such as patching the vulnerable firmware version 15.03.06.44 to eliminate the buffer overflow vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack buffer overflow in router web POST handler (/goform/SetSysTimeCfg) enables remote authenticated RCE on public-facing device interface (T1190) and directly supports privilege escalation from low-priv web account to full code execution (T1068).
NVD Description
A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Handler. Executing a manipulation of the argument Time can lead to stack-based buffer overflow.…
more
It is possible to launch the attack remotely. The exploit has been published and may be used.
Deeper analysisAI
CVE-2026-4974 is a stack-based buffer overflow vulnerability in the Tenda AC7 router running firmware version 15.03.06.44. The flaw resides in the fromSetSysTime function within the /goform/SetSysTimeCfg component of the POST Request Handler. By manipulating the Time argument, an attacker can trigger the overflow, as identified by CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write). The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-03-27.
The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring no user interaction and low attack complexity over the network. Successful exploitation grants high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the affected device.
Advisories from VulDB (ctiid.353861, id.353861, submit.778207) document the issue, and a proof-of-concept exploit is publicly available on a Notion site. The vendor's site at tenda.com.cn is referenced, but no specific patch or mitigation details are outlined in the available information.
An exploit has been published, indicating potential for real-world abuse against unpatched Tenda AC7 routers.
Details
- CWE(s)