CVE-2026-19788 in AC1206
Summary
by MITRE • 08/14/2026
A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the component httpd web management interface. The manipulation of the argument devName results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability exists within the Tenda AC1206 router firmware version 15.03.06.23_multi_TD01, specifically targeting the httpd web management interface component. The flaw resides in the set_device_name function located at /goform/SetOnlineDevName endpoint, where improper input validation allows attackers to exploit a stack-based buffer overflow condition through manipulation of the devName argument. The vulnerability demonstrates a classic software security weakness that directly relates to CWE-121 Stack-based Buffer Overflow, which occurs when a program writes more data to a fixed-length buffer than it can accommodate, potentially overwriting adjacent memory locations including return addresses and function pointers.
The remote exploitation capability of this vulnerability presents significant operational risks for network administrators and end users who may unknowingly expose their devices to malicious actors. Attackers can leverage this flaw by sending specially crafted HTTP requests to the vulnerable web interface, which would trigger the buffer overflow condition during processing of the devName parameter. This allows for arbitrary code execution on the affected device, potentially enabling full system compromise including persistent backdoor installation and unauthorized network access. The public availability of exploit code further amplifies the threat landscape, as it lowers the barrier to exploitation for attackers with minimal technical expertise.
The impact extends beyond simple device compromise to encompass potential network-wide consequences, particularly in environments where these routers serve as primary network gateways. Once compromised, affected devices can be used as entry points for lateral movement within local networks, potentially enabling attacks against connected IoT devices, workstations, and servers. The vulnerability aligns with several ATT&CK techniques including T1059 Command and Scripting Interpreter and T1078 Valid Accounts, as successful exploitation would likely allow attackers to establish persistent access and execute commands on the compromised device. Network segmentation and proper firewall rules may provide some mitigation, but the fundamental flaw in the firmware requires immediate remediation.
Recommended mitigations include immediate firmware updates from Tenda to address the identified buffer overflow vulnerability, implementation of network monitoring to detect suspicious HTTP traffic patterns targeting the affected endpoint, and disabling remote administrative access to the web interface when possible. Organizations should also consider implementing intrusion detection systems that can identify exploitation attempts targeting known vulnerabilities in networking equipment. The vulnerability demonstrates the critical importance of proper input validation and memory management practices in embedded systems, particularly those with web interfaces that are accessible from untrusted networks, as highlighted by industry best practices established in CWE guidelines for secure coding standards and defense-in-depth strategies against remote code execution attacks.