| Title | Tenda AC19 V16.03.10.07 Stack-based Buffer Overflow |
|---|
| Description | A stack-based buffer overflow (CWE-121) exists in the httpd web management service of the Tenda AC19 router (firmware V16.03.10.07): the formSetFirewallCfg handler, reachable unauthenticated via POST /goform/SetFirewallCfg, reads the user-controlled firewallEn parameter with websGetVar() and copies it into the fixed-size stack buffer "char dest[4]" using strcpy() without any upper-bound length check (only the lower bound strlen(src) >= 4 is validated), so a value longer than 4 bytes overflows the buffer and overwrites the adjacent stack frame. Because the httpd process runs with root privileges and no authentication or user interaction is required, an attacker with network access to the device web interface can send an overlong firewallEn value (e.g. 2000 'A' characters) to crash httpd and force the device to reboot, causing a denial of service that makes the management interface temporarily unreachable, while the stack overwrite also exposes a potential path to arbitrary code execution; the issue was verified on real hardware running firmware V16.03.10.07, with full technical details, decompiled code and PoC screenshots provided in the public advisory linked below. |
|---|
| Source | ⚠️ https://github.com/henrythekingofuk/TendaCVE |
|---|
| User | Zeming Hu (UID 101971) |
|---|
| Submission | 10/07/2026 15:00 (15 days ago) |
|---|
| Moderation | 10/20/2026 18:53 (13 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422925 [Tenda AC19 16.03.10.07 httpd Web Management Service /goform/SetFirewallCfg formSetFirewallCfg firewallEn stack-based overflow] |
|---|
| Points | 20 |
|---|