VulnSocial

CVE-2026-4974Disclosure(tenda / ac7)

LOWCVSS 7.4 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch tenda ac7 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Handler. Executing a manipulation of the argument Time can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

tenda CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-119CWE-121CWE-787

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • ac7
  • ac7_firmware

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-03-27); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
tenda
Products
ac7ac7_firmware

2 versions affected across 2 products

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-03-27: 1Mentions · 2026-03-28: 1Patch / Workaround · 2026-03-27: 1Technical Details · 2026-03-27: 1Technical Details · 2026-03-28: 103-2703-28
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-4974 A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Ha… https://www.cve.org/CVERecord?id=CVE-2026-4974

    Post summary

    A new vulnerability (CVE-2026-4974) was discovered in Tenda AC7 routers, impacting the fromSetSysTime function in the /goform/SetSysTimeCfg component; no exploit details, mitigation steps, or active exploitation are mentioned.

    00000112
    56.9K followersView on X
  • CVEFind.com@CveFindCom
    Disclosure

    [CVE-2026-4974: HIGH] Critical security vulnerability discovered in Tenda AC7! Stack-based buffer overflow possible through a remote attack on the Time argument. Users advised to update firmware immediately.#cve,CVE-2026-4974,#cybersecurity https://cvefind.com/CVE-2026-4974

    Post summary

    A high‑severity stack-based buffer overflow vulnerability (CVE‑2026‑4974) was announced in the Tenda AC7 router, with users advised to update firmware immediately.

    0000034
    617 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
HWtendaac71.0--
OStendaac7_firmware15.03.06.44--

Explore more

Back to dashboardtenda CVEsac7 vulnerabilities