{"id":"CVE-2026-113744","kind":"vulnerability","aliases":["CVE-2026-113744"],"related":[],"title":"Tenda AC19 router: remote stack overflow in web firewall setting","description":"A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.","summary":"Stack-based buffer overflow in formSetFirewallCfg (/goform/SetFirewallCfg, argument firewallEn) in the httpd web management service of Tenda AC19 firmware 16.03.10.07. The CVE record rates it CVSS 10.0 with no privileges or user interaction. An exploit reference is public (GitHub) but no in-the-wild exploitation is reported. No vendor advisory or fixed firmware was found. Whether the endpoint needs a login is not stated by the sources.","severity":"critical","cvss":10.0,"epss":0.00622,"exploited":false,"exploited_at":null,"products":[{"name":"Tenda AC19","fixed":[],"affected":"16.03.10.07","ecosystem":"firmware"}],"ecosystems":["firmware"],"tags":["ac19","home-router","infrastructure","self-hosted","tenda"],"not_affected_if":["default-config","remote-management-disabled"],"how_to_check":"Log in to the router admin page and read the firmware version under System Status/About. 16.03.10.07 is the only version confirmed affected; other versions are untested. Check whether remote/WAN web management is enabled (Tenda: Advanced > System > Remote Web Management) and whether the admin port is reachable from outside.","fix":"No fixed firmware published as of 2026-10-23 as far as the sources show. Check Tenda's support downloads for AC19 firmware newer than 16.03.10.07. Meanwhile: disable remote web management, keep the admin interface on trusted LAN only, and replace the device if no patch appears.","status":"open","published_at":"2026-10-21T02:17:07+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:33:23+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:33:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Tenda AC19 router: remote stack overflow in web firewall setting","impact":"high","summary":"A stack-based buffer overflow in the router's web management service lets a remote attacker send a crafted firewallEn argument to /goform/SetFirewallCfg. Public exploit details exist, so an attacker could likely take control of the router.","category":"infrastructure","who_cares":["tenda","home-router","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the router via the web management service","analyst_note":"Check whether the router's web admin is exposed to WAN and whether Tenda has released a firmware fix for AC19 16.03.10.07; the NVD entry does not state either.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000467,"input_tokens":2956,"output_tokens":342,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check whether the router's web admin is exposed to WAN and whether Tenda has released a firmware fix for AC19 16.03.10.07; the NVD entry does not state either.","search":"'-113744':13A,16A '-2026':12A,15A '/goform/setfirewallcfg':35B,117C '10.0':55B '16.03.10.07':48B,106C 'ac19':2A,18A,19B,46B,105C 'advisori':79B 'argument':36B,129C 'attack':139C 'base':30B,135C 'buffer':31B,136C 'compon':120C 'cve':11A,14A,50B 'cvss':54B 'detect':102C 'disclos':148C 'element':109C 'endpoint':87B 'exploit':63B,74B,145C 'file':116C 'firewal':9A 'firewallen':37B,130C 'firmwar':47B,82B 'fix':81B 'formsetfirewallcfg':34B,113C 'found':84B 'function':112C 'github':67B 'home':21B 'home-rout':20B 'host':26B 'httpd':40B,121C 'impact':108C 'in-the-wild':70B 'infrastructur':23B 'interact':61B 'launch':142C 'lead':131C 'login':90B 'manag':42B,123C 'manipul':126C 'may':140C,151C 'need':88B 'overflow':6A,32B,137C 'privileg':58B 'public':66B,149C 'rate':52B 'record':51B 'refer':64B 'remot':4A,143C 'report':76B 'router':3A,22B 'secur':98C 'self':25B 'self-host':24B 'servic':43B,124C 'set':10A 'sourc':96B 'stack':5A,29B,134C 'stack-bas':28B,133C 'state':93B 'tenda':1A,17A,27B,45B,104C 'use':153C 'user':60B 'vendor':78B 'vulner':99C 'web':8A,41B,122C 'whether':85B 'wild':73B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T02:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-113744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113744","severity":null,"published_at":"2026-10-21T02:17:07+00:00","modified_at":"2026-10-21T14:26:26+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113744:317","url":null,"severity":null,"published_at":"2026-10-23T22:53:10+00:00","modified_at":"2026-10-23T22:53:10+00:00","first_seen_at":"2026-10-23T22:53:10+00:00","fetched_at":"2026-10-23T22:53:10+00:00","note":"CVE record (VulDB CNA) lists only AC19 16.03.10.07 affected; no vendor advisory or fixed firmware found; PoC repo referenced in CVE record (README empty when read); no exploitation reports; X has 2 posts only, none saved."},{"source":"epss","external_id":"CVE-2026-113744","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113744","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":1645,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-113744","title":"CVE record CVE-2026-113744 (VulDB CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1646,"url":"https://github.com/henrythekingofuk/TendaCVE","title":"henrythekingofuk/TendaCVE (exploit reference in CVE record; README empty when read)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1647,"url":"https://www.ionix.io/threat-center/cve-2026-113744/","title":"IONIX: CVE-2026-113744","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}