Tenda AC1206 CVE-2026-19789

Exploitation requires network access to the Tenda AC1206 httpd web management interface and authentication at a low-privilege level, as reflected by the CVSS 4.0 PR:L metric - unauthenticated exploitation is not confirmed from available data. The specific trigger is a POST request to the /goform/WifiGuestSet endpoint with a malformed shareSpeed parameter of sufficient length to overflow the stack buffer in set_wl_guest_iplist. If the router's WAN-side remote management is disabled (a common default), exploitation is limited to attackers already present on the local network or guest wireless segment. The limiting factors are: the PR:L authentication requirement (though default/weak credentials reduce this barrier significantly on consumer hardware), LAN-local access if remote management is off, and the specific firmware version 15.03.06.23_multi_TD01 - other firmware builds are not confirmed vulnerable from available data.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 7.4 and conveys a network-reachable, low-complexity exploit requiring only low-privilege authentication with no user interaction, yielding full confidentiality, integrity, and availability impact to the vulnerable system. The E:P supplemental metric reflects the publicly disclosed PoC. There is no EPSS score present in the provided data, which limits probabilistic exploitation forecasting. No CISA KEV listing is present, meaning confirmed active mass exploitation is not established - however, the combination of a public PoC, network exploitability, consumer IoT deployment patterns (where firmware updates are rarely applied), and the near-certain root-level execution context of httpd elevates realistic risk well above what the 7.4 score alone might suggest for enterprise-class software. The PR:L requirement is a meaningful limiting factor: unauthenticated exploitation is not confirmed from available data and should not be assumed. If default or weak credentials are widespread on this model (a common condition for consumer routers), PR:L may present a minimal real-world barrier.

An attacker with low-privilege credentials to the Tenda AC1206 web interface - obtained via default credentials, brute force, or credential reuse - sends a crafted HTTP POST request to /goform/WifiGuestSet with an oversized shareSpeed value. The set_wl_guest_iplist function copies the value into a fixed stack buffer, overwriting the saved return address; upon function return, execution redirects to attacker-controlled code running as the httpd process (typically root). A public PoC documented at https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/2.md provides the technical basis for this scenario.