CVE-2026-113744
A security vulnerability has been detected in Tenda AC19 16.03.10.07
- Risk score
- 75/100
- CVSS
- 10.0 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A stack-based buffer overflow vulnerability in the httpd Web Management Service of Tenda AC19 16.03.10.07 allows remote attackers to potentially execute arbitrary code. An attacker could exploit this vulnerability to gain control of the device.
- Affected
- {'products': ['Tenda AC19'], 'packages': [], 'versions': ['16.03.10.07']}
- Fix
- Check the linked advisory for the concrete fix.
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Last activity 21 Oct 2026. Patch Forecast updates every hour.