---
id: "CVE-2026-123966"
page: "https://infrastack.ai/live/CVE-2026-123966"
kind: "vulnerability"
aliases: ["CVE-2026-123966"]
title: "Tenda AC19 router: remote heap overflow in parental control setting"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Tenda AC19", "fixed": [], "affected": "16.03.10.07", "ecosystem": "firmware"}]
ecosystems: []
tags: ["ac19", "firmware", "home-router", "infrastructure", "router", "tenda"]
not_affected_if: ["different-firmware", "different-model", "management-not-exposed"]
published_at: "2026-11-07T14:17:01+00:00"
first_seen_at: "2026-11-07T14:47:39+00:00"
updated_at: "2026-11-07T14:50:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123966", "first_seen_at": "2026-11-07T14:47:39+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/432038", "first_seen_at": "2026-11-07T14:50:44+00:00", "cites": ["https://vuldb.com/vuln/432038"]}]
exploit_sources: []
---

# Tenda AC19 router: remote heap overflow in parental control setting

Link for people: https://infrastack.ai/live/CVE-2026-123966 (this .md is for agents)

A heap-based buffer overflow in the saveParentControlInfo handler of Tenda AC19 routers (firmware 16.03.10.07) is triggered by an oversized deviceId argument sent to /goform/saveParentControlInfo. An attacker on the network can likely crash the router or run code on it, and a public exploit has been disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- firmware:Tenda AC19 affected 16.03.10.07 fixed no fixed version listed

## How to check

- Log in to the router admin page and read the firmware version (System Status / About). 16.03.10.07 is the version named as vulnerable; other versions are not confirmed either way.
- Check whether the admin web interface is reachable from the internet (remote management / port forwarding of port 80). VulDB states no authentication is required to exploit it.
- Also check any other Tenda model that exposes /goform/saveParentControlInfo; earlier CVEs hit AC10, AC15 and AC23 on this endpoint.

## Timeline

- 2026-11-07T14:47:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123966
- 2026-11-07T14:50:44+00:00 analyst https://vuldb.com/vuln/432038 — Only VulDB (CNA) entry VDB-432038 found; no Tenda advisory or fixed firmware located, so nothing marked verified. VulDB says no auth required, remote, PoC on GitHub (link not public in page, not read), no known countermeasure. Only 16.03.10.07 confirmed affected; other firmware unknown. Same endpoint has had past bugs on AC10/AC15/AC23, separate CVEs.

## Documents

- [describes] VulDB VDB-432038: Tenda AC19 16.03.10.07 saveParentControlInfo deviceId heap-based overflow https://vuldb.com/vuln/432038

## From the sources

A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_