CVE-2026-113744 in AC19
Summary
by MITRE • 10/22/2026
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The Tenda AC19 router, specifically running firmware version 16.03.10.07, contains a critical security flaw within its embedded web management interface that allows for remote code execution through stack-based buffer overflow exploitation. This vulnerability resides in the httpd Web Management Service, which is responsible for handling administrative requests from users attempting to configure network settings via a browser-based dashboard. The specific point of failure is located in the formSetFirewallCfg function within the /goform/SetFirewallCfg endpoint. This component processes user-supplied input related to firewall configuration parameters, particularly focusing on an argument named firewallEn which dictates whether certain firewall rules are enabled or disabled. Due to insufficient bounds checking during the processing of this parameter, the application fails to validate the length of the incoming data before copying it into a fixed-size buffer allocated on the stack.
This lack of input validation leads directly to a classic stack-based buffer overflow condition as defined by Common Weakness Enumeration (CWE) identifier CWE-121. When an attacker sends a specially crafted HTTP request with a payload exceeding the expected size for the firewallEn argument, the excess data overwrites adjacent memory locations on the call stack. This overwrite can corrupt critical control flow data such as the return address of the function or saved frame pointers. By carefully crafting this overflow to include shellcode or redirect execution to existing executable code within the binary, an attacker can achieve arbitrary code execution with the privileges of the web server process, which typically runs with elevated system rights on embedded devices like routers.
The operational impact of this vulnerability is severe due to its remote nature and public availability. Because the affected service listens for incoming connections from local networks or potentially exposed internet-facing interfaces depending on port forwarding configurations, an unauthenticated attacker can launch exploits remotely without prior access credentials. The fact that a working exploit has been disclosed publicly significantly lowers the barrier to entry for malicious actors, including automated botnets seeking to compromise IoT devices for use in distributed denial-of-service attacks or as part of larger command and control infrastructures. Successful exploitation allows the adversary to gain full control over the router, enabling them to intercept network traffic, redirect users to phishing sites, install persistent malware, or pivot into more sensitive internal networks that rely on this device for connectivity.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to initial access and execution via web services. Attackers can leverage known exploit kits or custom scripts to target vulnerable instances at scale. The persistence of such vulnerabilities in consumer-grade networking equipment highlights the ongoing challenge of secure coding practices within embedded Linux environments where memory safety is not guaranteed by default language features as they are in higher-level managed languages.
Mitigation strategies must be implemented immediately to reduce exposure risk. The primary and most effective remediation is to apply the latest firmware update provided by Tenda, which should include patches for this buffer overflow issue. Until an official patch is available or applied, network administrators should restrict access to the router's web management interface by disabling remote administration features if they are not strictly necessary. Additionally, implementing strict firewall rules at the perimeter level to block inbound traffic destined for port 80 and 443 on the internal IP address of the router can prevent external exploitation attempts. It is also advisable to change default administrative passwords and ensure that management interfaces are only accessible from trusted local subnets rather than being exposed to untrusted networks or the public internet.