---
id: "CVE-2026-113744"
kind: "vulnerability"
aliases: ["CVE-2026-113744"]
title: "Tenda AC19 router: remote stack overflow in web firewall setting"
severity: "critical"
cvss: 10.0
epss: 0.00622
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Tenda AC19", "fixed": [], "affected": "16.03.10.07", "ecosystem": "firmware"}]
ecosystems: ["firmware"]
tags: ["ac19", "home-router", "infrastructure", "self-hosted", "tenda"]
not_affected_if: ["default-config", "remote-management-disabled"]
published_at: "2026-10-21T02:17:07+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113744", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:53:10+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-113744", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Tenda AC19 router: remote stack overflow in web firewall setting

Stack-based buffer overflow in formSetFirewallCfg (/goform/SetFirewallCfg, argument firewallEn) in the httpd web management service of Tenda AC19 firmware 16.03.10.07. The CVE record rates it CVSS 10.0 with no privileges or user interaction. An exploit reference is public (GitHub) but no in-the-wild exploitation is reported. No vendor advisory or fixed firmware was found. Whether the endpoint needs a login is not stated by the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- firmware:Tenda AC19 affected 16.03.10.07 fixed ?

## How to check

Log in to the router admin page and read the firmware version under System Status/About. 16.03.10.07 is the only version confirmed affected; other versions are untested. Check whether remote/WAN web management is enabled (Tenda: Advanced > System > Remote Web Management) and whether the admin port is reachable from outside.

## Fix

No fixed firmware published as of 2026-10-23 as far as the sources show. Check Tenda's support downloads for AC19 firmware newer than 16.03.10.07. Meanwhile: disable remote web management, keep the admin interface on trusted LAN only, and replace the device if no patch appears.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113744
- 2026-10-23T22:53:10+00:00 analyst — CVE record (VulDB CNA) lists only AC19 16.03.10.07 affected; no vendor advisory or fixed firmware found; PoC repo referenced in CVE record (README empty when read); no exploitation reports; X has 2 posts only, none saved.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-113744

## Documents

- [advisory] CVE record CVE-2026-113744 (VulDB CNA) https://cveawg.mitre.org/api/cve/CVE-2026-113744
- [mentions] IONIX: CVE-2026-113744 https://www.ionix.io/threat-center/cve-2026-113744/
- [poc] henrythekingofuk/TendaCVE (exploit reference in CVE record; README empty when read) https://github.com/henrythekingofuk/TendaCVE

## From the sources

A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_