A buffer overflow vulnerability has been disclosed in Tenda’s dual-band AC19 gigabit router that lets anyone with network access to the device crash it with a single request. The flaw, tracked as CVE-2026-123966, was added to the NVD database on November 7 and has a CVSS 3.1 score of 10.0. Sample code showing how to exploit it has also been publicly available on GitHub since mid-October.
Where the flaw is
The issue is at /goform/saveParentControlInfo, which handles the parental control entry in the router’s web management interface. The device copies the deviceId parameter sent to this address into a 596-byte heap buffer without checking its length at all. Once the parameter exceeds the limit, adjacent memory areas get corrupted. The time and urls fields sent in the same request are also copied without proper validation; according to the researcher’s analysis, these write without bounds into 4-byte stack buffers.
What makes this flaw critical is that this endpoint does not require login at all. In other words, anyone who can reach the router’s interface can send this request without knowing the username or password. Since the code runs inside the device’s management service and with high privileges, the bug does more than just crash the service; if the memory corruption can be used in a controlled way, it could potentially lead all the way to remote code execution.
Observed impact
When the researcher sent a request with 600-byte values to the test device, the router’s web interface became temporarily unavailable and the device rebooted itself. If repeated continuously, that means regular network outages: the home internet connection drops, and connected cameras and smart home devices go offline. Repeated requests can make the device effectively unmanageable.
Which devices are affected
The flaw was confirmed in firmware version 16.03.10.07 of the AC19. It is not clear whether Tenda has released a newer firmware version for this model; the NVD entry only includes the vendor’s homepage link, with no security advisory or patch notes. So at the moment, there is no known version I can point to and say, “update to this and you’re safe.”
The device’s default management address is 192.168.0.1. Because the flaw requires network access to the interface, it can be triggered not by a direct attack from the internet, but by an attacker on the same network or one who has already managed to get into the network. Still, if remote management is enabled on the modem, that door can also be opened directly to the outside.
What to do
For AC19 users, the first step is to check the model’s firmware version on Tenda’s support page and install it if there is a version newer than 16.03.10.07. If there is no newer version, disabling remote management in the device interface, changing the management password from the default value, and, if possible, keeping the router on a separate network segment will reduce the risk. The device rebooting on its own or the interface failing to open for no apparent reason may be signs that this flaw is being exploited.
For those who think the router is no longer supported, the most reliable solution is to replace it with a model that is still receiving firmware support. On the same day, a similar overflow flaw was also disclosed in TOTOLINK’s CA300-PoE access point; with these kinds of small office and home network devices, it’s important not to let firmware tracking slip.
Source: NVD · researcher report
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.