Tenda AC19: Stack-based buffer overflow in httpd web management service
Summary
A stack-based buffer overflow in the httpd web management service of the Tenda AC19 router (firmware 16.03.10.07) can be triggered remotely via the firewallEn argument of the formSetFirewallCfg function at /goform/SetFirewallCfg. An unauthenticated attacker who can reach the admin interface may be able to execute code or take over the device. Public proof-of-concept exploit code is referenced, and VulDB rates exploit maturity as Proof-of-Concept.
Affected
- Tenda AC19 firmware 16.03.10.07 (listed as affected in the CVE data)
- Other firmware versions: unknown, not listed in the CVE data
- Tenda's download pages list V16.03.10.11 as the newest AC19 build found; its status is unknown.
Fixed in
Unknown. No Tenda security advisory or confirmed fixed firmware version found.
Workaround
- Disable remote access to the web admin interface and do not expose it on the WAN.
- Limit admin access to the LAN or to a specific management IP address.
- Disable UPnP port openings that could expose the admin interface.
- Isolate the device behind a firewall where possible.
Exploitation
- Public proof-of-concept exploit code is referenced in the CVE record (GitHub repository henrythekingofuk/TendaCVE). Its content was not assessed.
- VulDB rates exploit maturity as Proof-of-Concept; CISA SSVC lists Exploitation: poc and Automatable: yes.
- Known exploitation in the wild: unconfirmed.
Our recommendation
- Inventory all Tenda AC19 devices and record their firmware version.
- Disable WAN and remote management access immediately, and restrict admin access to trusted LAN addresses.
- Check whether the device is used as an edge router or sole firewall and treat it as a priority.
- Contact Tenda support to confirm a fixed firmware version before rollout; plan replacement or isolation if no fix is confirmed.
- Monitor the device and your network for unusual traffic to the admin interface.
- Plan for a factory reset and reconfiguration after any firmware update, as Tenda recommends.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-113744 vuldb.com
- VulDB vulnerability 422925 vuldb.com
- CVE Threat Intelligence record cve.threatint.com
- Hol.org CVE record hol.org
- Strix CVE record www.strix.ai
- Offseq threat record radar.offseq.com
- Tenda AC19 product help page www.tendacn.com
- Tenda vendor site www.tenda.com.cn
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:01.
Original description (NVD)
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.