Plaintext Credential Leakage in Tenda AC7 Firmware
CVE-2026-24441

8.2HIGH

Key Information:

Vendor

Shenzhen Tenda Technology Co., Ltd.

Status
Tenda Ac7
Vendor
CVE Published:
3 February 2026

What is CVE-2026-24441?

The firmware of Tenda AC7 routers up to version V03.03.03.01_cn is susceptible to a security issue where sensitive account credentials are transmitted in plaintext over HTTP responses. This flaw could allow an attacker positioned on the network path to intercept these credentials, potentially compromising user accounts and exposing sensitive information. Users are advised to update their devices and implement secure protocols to ensure the protection of authentication data.

Affected Version(s)

Tenda AC7 0 <= 03.03.03.01_cn

References

https://www.tendacn.com/product/AC7
product
https://www.vulncheck.com/advisories/tenda-ac7-transmits-...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
.