CVE-2025-11586

Name of the Vulnerable Software and Affected Versions Tenda AC7 version 15.03.06.44

Description A stack-based buffer overflow exists in the Tenda AC7 router firmware. The issue is located in an unknown function within the /goform/setNotUpgrade endpoint. Manipulation of the newVersion argument causes the overflow, and the attack can be carried out remotely. The exploit has been publicly disclosed.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /goform/setNotUpgrade endpoint to minimize the risk of exploitation.