What’s Vulnerable › Vulnerabilities

CVE-2026-24427: Tenda AC7 Exposes Admin Credentials in Configuration Responses

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-03 · updated 2026-06-17
• Weakness: CWE-201

Description

Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose sensitive information in web management responses. Administrative credentials, including the router and/or admin panel password, are included in plaintext within configuration response bodies. In addition, responses lack appropriate Cache-Control directives, which may permit web browsers to cache pages containing these credentials and enable subsequent disclosure to an attacker with access to the client system or browser profile.

Affected products

• Tenda AC7: through 03.03.03.01

References

• https://www.tendacn.com/product/AC7
• https://www.vulncheck.com/advisories/tenda-ac7-exposes-admin-credentials-in-configuration-responses

Get alerted when CVE-2026-24427 or the next vulnerability affects your stack