High 8.2Published Feb 3, 2026

CVE-2026-24441Tenda AC7 Transmits Admin Credentials Without HTTPS Protection

Updated under an hour ago (Oct 27, 2026, 9:50 AM ET)

Does this affect you?

It affects Shenzhen Tenda Technology Co., Ltd. Tenda AC7 and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Shenzhen Tenda Technology Co., Ltd. Tenda AC7

Exploited in the last 30 days

Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose account credentials in plaintext within HTTP responses, allowing an on-path attacker to obtain sensitive authentication material.

CVSS: 8.2 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-319
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Analyzed
Record last updated: May 13, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Shenzhen Tenda Technology Co., Ltd. Tenda AC7 shenzhen_tenda_technology:tenda_ac7 (from the name)	through 03.03.03.01_cn	CNA record
tenda ac7_firmware tenda:ac7_firmware	through 03.03.03.01	NVD

References

References

https://www.tendacn.com/product/AC7	product
https://www.vulncheck.com/advisories/tenda-ac7-transmits-admin-credentials-without-https-protection	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.