CVE-2026-123966
CriticalCVSS 10.0Summary
A vulnerability was found in Tenda AC19 version 16.03.10.07 in the saveParentControlInfo function of the /goform/saveParentControlInfo file. Manipulating the deviceId argument causes a heap-based buffer overflow. The attack can be carried out remotely, and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker can use the publicly known exploit to trigger a heap buffer overflow, potentially leading to code execution or device crash. Internet-facing devices are especially at risk.
Recommendation
Update Tenda AC19 firmware to the latest version or restrict access to the management interface. If no update is available, consider disabling parental control or isolating the device on the network.
Other vulnerabilities in Tenda AC19
Original NVD description (English source)
A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS