Tenda AC1206 CVE-2026-19788

Exploitation requires the attacker to hold a valid authenticated session on the Tenda AC1206 web management interface (CVSS PR:L), meaning at minimum low-level credentials must be obtained or already known. The httpd service running the vulnerable /goform/SetOnlineDevName endpoint must be network-reachable from the attacker's position - this is the default state on LAN-side interfaces and potentially on WAN if remote management is enabled (non-default). No additional special configuration beyond a standard deployment is required once authentication is achieved. The key limiting factor is authentication: attackers without valid credentials cannot directly trigger the overflow, making credential hygiene a partial but meaningful mitigating control. No user interaction beyond the attacker's own request is required, and attack complexity is low once access is established.

The CVSS 4.0 base score of 7.4 is assigned with AV:N/AC:L/AT:N/PR:L/UI:N and full VC:H/VI:H/VA:H impact on the vulnerable system, reflecting a network-reachable, low-complexity flaw that requires only low-level authenticated access. The E:P threat modifier confirms a publicly available exploit, which meaningfully shortens the window between disclosure and opportunistic exploitation. No CISA KEV entry was identified at time of analysis, so active mass exploitation is not confirmed, but the presence of a public POC on GitHub raises the realistic exploitation probability significantly. This is not a theoretical high-CVSS-but-low-real-risk issue - even a mid-sized municipal IT team in legnica that deployed Tenda AC1206 units as guest network access points should treat this as urgent, as the management interface may be reachable from within a trusted LAN segment where low-privileged users could authenticate. The scope is unchanged (S:U / SC:N/SI:N/SA:N), meaning exploitation is contained to the router itself, but full device compromise - including traffic interception, DNS manipulation, or use as a pivot point - is a realistic consequence.

An attacker with valid credentials to the Tenda AC1206 web management interface - potentially obtained through credential stuffing, default password reuse, or lateral movement - sends a crafted HTTP POST request to /goform/SetOnlineDevName with an oversized devName parameter. The oversized value overflows the stack buffer in set_device_name, corrupting the saved return address and redirecting execution to attacker-controlled code. A public proof-of-concept demonstrating this technique has been published at https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/1.md.