{"id":"CVE-2026-123966","kind":"vulnerability","aliases":["CVE-2026-123966"],"related":[],"title":"Tenda AC19 router: remote heap overflow in parental control setting","description":"A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.","summary":"A heap-based buffer overflow in the saveParentControlInfo handler of Tenda AC19 routers (firmware 16.03.10.07) is triggered by an oversized deviceId argument sent to /goform/saveParentControlInfo. An attacker on the network can likely crash the router or run code on it, and a public exploit has been disclosed.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Tenda AC19","fixed":[],"affected":"16.03.10.07","ecosystem":"firmware"}],"ecosystems":[],"tags":["ac19","firmware","home-router","infrastructure","router","tenda"],"not_affected_if":["different-firmware","different-model","management-not-exposed"],"how_to_check":"- Log in to the router admin page and read the firmware version (System Status / About). 16.03.10.07 is the version named as vulnerable; other versions are not confirmed either way.\n- Check whether the admin web interface is reachable from the internet (remote management / port forwarding of port 80). VulDB states no authentication is required to exploit it.\n- Also check any other Tenda model that exposes /goform/saveParentControlInfo; earlier CVEs hit AC10, AC15 and AC23 on this endpoint.","fix":null,"status":"open","published_at":"2026-11-07T14:17:01+00:00","first_seen_at":"2026-11-07T14:47:39+00:00","triaged_at":"2026-11-07T14:49:46+00:00","updated_at":"2026-11-07T14:50:44+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T14:49:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Tenda AC19 router: remote heap overflow in parental control setting","impact":"high","summary":"A heap-based buffer overflow in the saveParentControlInfo handler of Tenda AC19 routers (firmware 16.03.10.07) is triggered by an oversized deviceId argument sent to /goform/saveParentControlInfo. An attacker on the network can likely crash the router or run code on it, and a public exploit has been disclosed.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["tenda","ac19","router","home-router","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the router and takes control of the network","analyst_note":"Confirm affected firmware range and whether a vendor fix exists; the NVD entry gives no fixed version or authentication detail.","how_to_check":"- Check the firmware version on the router's admin page against `16.03.10.07`\n- Check whether the web admin interface is reachable from the internet (unknown if sources give a specific check)","plain_action":"If you own a Tenda AC19 router, check its firmware version and wait for Tenda to release a fix before relying on it for untrusted traffic.","needs_analyst":true,"not_affected_if":["different-model","different-firmware","management-not-exposed"],"who_is_affected":"Owners and businesses running Tenda AC19 routers on firmware 16.03.10.07, where the web management interface accepts parental control requests. Exposure is greatest where the router's management interface is reachable from the internet or from untrusted networks. Devices not running this model or firmware are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000735,"input_tokens":4236,"output_tokens":622,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm affected firmware range and whether a vendor fix exists; the NVD entry gives no fixed version or authentication detail.","search":"'-123966':13A,16A '-2026':12A,15A '/goform/saveparentcontrolinfo':52B,94C '16.03.10.07':42B,82C 'ac19':2A,18A,19B,39B,81C 'affect':83C 'argument':49B,99C 'attack':54B,108C 'base':30B,104C 'buffer':31B,105C 'carri':113C 'caus':101C 'code':65B 'control':9A 'crash':60B 'cve':11A,14A 'determin':78C 'deviceid':48B,100C 'disclos':74B,121C 'exploit':71B,117C 'file':93C 'firmwar':20B,41B 'function':89C 'handler':36B 'heap':5A,29B,103C 'heap-bas':28B,102C 'home':22B 'home-rout':21B 'infrastructur':24B 'issu':86C 'like':59B 'manipul':96C 'may':123C 'network':57B 'overflow':6A,32B,106C 'overs':47B 'parent':8A 'possibl':110C 'public':70B,120C 'remot':4A,115C 'router':3A,23B,25B,40B,62B 'run':64B 'saveparentcontrolinfo':35B,90C 'sent':50B 'set':10A 'tenda':1A,17A,26B,38B,80C 'trigger':44B 'util':125C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Owners of a Tenda AC19 router running firmware 16.03.10.07. VulDB says a remote attacker needs no login to send an oversized deviceId to /goform/saveParentControlInfo and cause a heap overflow, which can crash the router and may allow code execution. Exposure is highest if the admin interface is reachable from the internet; other models and firmware versions are not confirmed affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you own a Tenda AC19 router, check its firmware version and wait for Tenda to release a fix before relying on it for untrusted traffic.","pkeys":["ac19","tendaac19"],"ptokens":["ac19","tenda"],"labels":["ac19","critical","firmware","homerouter","infrastructure","router","tenda"],"campaign_type":null,"search_a":"'-123966':13A,16A '-2026':12A,15A 'ac19':2A,18A 'control':9A 'cve':11A,14A 'heap':5A 'overflow':6A 'parent':8A 'remot':4A 'router':3A 'set':10A 'tenda':1A,17A","search_b":"'/goform/saveparentcontrolinfo':52B '16.03.10.07':42B 'ac19':19B,39B 'argument':49B 'attack':54B 'base':30B 'buffer':31B 'code':65B 'crash':60B 'deviceid':48B 'disclos':74B 'exploit':71B 'firmwar':20B,41B 'handler':36B 'heap':29B 'heap-bas':28B 'home':22B 'home-rout':21B 'infrastructur':24B 'like':59B 'network':57B 'overflow':32B 'overs':47B 'public':70B 'router':23B,25B,40B,62B 'run':64B 'saveparentcontrolinfo':35B 'sent':50B 'tenda':26B,38B 'trigger':44B","search_c":"'/goform/saveparentcontrolinfo':94C '16.03.10.07':82C 'ac19':81C 'affect':83C 'argument':99C 'attack':108C 'base':104C 'buffer':105C 'carri':113C 'caus':101C 'determin':78C 'deviceid':100C 'disclos':121C 'exploit':117C 'file':93C 'function':89C 'heap':103C 'heap-bas':102C 'issu':86C 'manipul':96C 'may':123C 'overflow':106C 'possibl':110C 'public':120C 'remot':115C 'saveparentcontrolinfo':90C 'tenda':80C 'util':125C 'vulner':76C","first_public_at":"2026-11-07T14:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123966","severity":null,"published_at":"2026-11-07T14:17:01+00:00","modified_at":"2026-11-07T14:17:01+00:00","first_seen_at":"2026-11-07T14:47:39+00:00","fetched_at":"2026-11-07T14:47:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123966:2128","url":"https://vuldb.com/vuln/432038","severity":null,"published_at":"2026-11-07T14:50:44+00:00","modified_at":"2026-11-07T14:50:44+00:00","first_seen_at":"2026-11-07T14:50:44+00:00","fetched_at":"2026-11-07T14:50:44+00:00","note":"Only VulDB (CNA) entry VDB-432038 found; no Tenda advisory or fixed firmware located, so nothing marked verified. VulDB says no auth required, remote, PoC on GitHub (link not public in page, not read), no known countermeasure. Only 16.03.10.07 confirmed affected; other firmware unknown. Same endpoint has had past bugs on AC10/AC15/AC23, separate CVEs.","cites":["https://vuldb.com/vuln/432038"]}],"documents":[{"id":96185,"url":"https://vuldb.com/vuln/432038","title":"VulDB VDB-432038: Tenda AC19 16.03.10.07 saveParentControlInfo deviceId heap-based overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}