Which versions of Tenda AC12 are affected by CVE-2026-19821?

Tenda AC12 routers (firmware 15.03.06.23_multi_TD01) contain a critical remote code execution vulnerability enabling low-privileged attackers to execute arbitrary code through HTTP requests; publicly…

How to fix or mitigate CVE-2026-19821?

Within 24 hours, identify and inventory all Tenda AC12 routers running firmware 15.03.06.23_multi_TD01 across your network. Within 7 days, implement interim protections: deploy WAF rules to block or sanitize oversized requests to the `/goform/SetSysAutoRebbotCfg` endpoint, restrict management interface access to authorized networks only, disable remote management if operationally feasible, and enable detailed logging of all router access. Within 30 days, evaluate replacement options from alternative vendors and establish a hardware replacement timeline, as Tenda has not released a patch for this vulnerability.

Tenda AC12 CVE-2026-19821

Q: What is the CVSS score of CVE-2026-19821?

CVE-2026-19821 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-58616 HIGH

Buffer Overflow (CWE-119)

2026-08-14 cna@vuldb.com

GHSA-ch7j-xq25-cfm2

Buffer Overflow Tenda

7.4

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable management endpoint requires low-privilege authentication; successful buffer overflow yields full device compromise with no scope change to adjacent systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 11:31 vuln.today

CVE Published

Aug 14, 2026 - 11:16 cve.org

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stack/heap buffer overflow in the Tenda AC12 router (firmware 15.03.06.23_multi_TD01) allows remote low-privileged attackers to potentially execute arbitrary code by sending a crafted HTTP request to the /goform/SetSysAutoRebbotCfg endpoint with an oversized rebootTime argument. All three impact pillars - confidentiality, integrity, and availability - are rated high for the vulnerable system per the CVSS 4.0 vector. Publicly available exploit code exists per a GitHub PoC disclosure; no confirmed CISA KEV listing was identified at time of analysis.

Technical ContextAI

The Tenda AC12 is a consumer/SOHO wireless router running an embedded Linux httpd web management interface. The CGI handler function formSetRebootTimer, exposed at the endpoint /goform/SetSysAutoRebbotCfg, is responsible for processing user-submitted auto-reboot scheduling parameters. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) identifies the root cause: the rebootTime parameter value is read from the HTTP request and copied or processed into a fixed-size stack or heap buffer without adequate length validation. This allows an attacker-controlled oversized string to overwrite adjacent memory regions - potentially including saved return addresses or function pointers - enabling redirection of execution flow to attacker-supplied code. The firmware version confirmed affected is 15.03.06.23_multi_TD01; no CPE string was provided in the intelligence data.

RemediationAI

No vendor-released patch has been identified at time of analysis; administrators should monitor the Tenda vendor page (https://www.tenda.com.cn/) for firmware updates addressing this firmware line. As an immediate compensating control, disable or restrict access to the router's web management interface from untrusted network segments - specifically, ensure the management interface is not exposed on the WAN interface, which eliminates remote internet-based exploitation. On the LAN side, use firewall or VLAN rules to limit which hosts can reach the router's management port (typically TCP 80/443 on the LAN IP), reducing lateral-movement attack surface. Changing default credentials removes the most accessible path to satisfying the PR:L prerequisite. Note that none of these controls patch the underlying buffer overflow; they are exposure-reduction measures only and do not protect against a LAN-side attacker with valid credentials.