CVE-2026-24426— Tenda AC7 Reflected XSS via Web Interface Output Encoding
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-24426
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Tenda AC7 Reflected XSS via Web Interface Output Encoding
Source: NVD (National Vulnerability Database)
Vulnerability Description
Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior contain an improper output encoding vulnerability in the web management interface. User-supplied input is reflected in HTTP responses without adequate escaping, allowing injection of arbitrary HTML or JavaScript in a victim’s browser context.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Tenda AC7 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Tenda AC7是中国腾达（Tenda）公司的一款无线路由器。 Tenda AC7 V03.03.03.01_cn及之前版本存在跨站脚本漏洞，该漏洞源于Web管理界面存在输出编码不当，可能导致在受害者浏览器环境中注入任意HTML或JavaScript。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Shenzhen Tenda Technology Co., Ltd. | Tenda AC7 | 0 ~ 03.03.03.01_cn | - |
II. Public POCs for CVE-2026-24426
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-24426
请登录查看更多情报信息。
Same Patch Batch · Shenzhen Tenda Technology Co., Ltd. · 2026-02-03 · 4 CVEs total
| CVE-2026-24441 | Tenda AC7 Transmits Admin Credentials Without HTTPS Protection | |
| CVE-2026-24427 | Tenda AC7 Exposes Admin Credentials in Configuration Responses | |
| CVE-2026-24434 | Tenda AC7 Web Interface Lacks CSRF Protections for Admin Actions |
IV. Related Vulnerabilities
Same vendor: Shenzhen Tenda Technology Co., Ltd.
- CVE-2026-27514
Tenda F3 Plaintext Credential Exposure in Configuration Down - CVE-2026-27513
Tenda F3 CSRF in Web Management Interface - CVE-2026-27512
Tenda F3 Reflected Script Execution via Missing nosniff Head - CVE-2026-27511
Tenda F3 Clickjacking in Web Management Interface - CVE-2026-24441
Tenda AC7 Transmits Admin Credentials Without HTTPS Protecti
Same weakness: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. Comments for CVE-2026-24426
No comments yet