Plaintext Credential Leakage in Tenda AC7 Firmware
CVE-2026-24441

8.2HIGH

Key Information:

Vendor

Shenzhen Tenda Technology Co., Ltd.

Status
Tenda Ac7
Vendor
CVE Published:
3 February 2026

What is CVE-2026-24441?

The firmware of Tenda AC7 routers up to version V03.03.03.01_cn is susceptible to a security issue where sensitive account credentials are transmitted in plaintext over HTTP responses. This flaw could allow an attacker positioned on the network path to intercept these credentials, potentially compromising user accounts and exposing sensitive information. Users are advised to update their devices and implement secure protocols to ensure the protection of authentication data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Tenda AC7 0 <= 03.03.03.01_cn

References

https://www.tendacn.com/product/AC7
product
https://www.vulncheck.com/advisories/tenda-ac7-transmits-...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
JSON
.