Which versions of Tenda AC10 are affected by CVE-2026-19924?

Tenda AC10 routers (firmware 16.03.10.09_multi_TDE01) contain an unauthenticated authentication bypass allowing remote attackers to gain complete administrative access to the web management interface…

Is there a public PoC exploit available for CVE-2026-19924?

Yes, a public proof-of-concept exploit is available for CVE-2026-19924. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-19924?

Within 24 hours: Inventory all Tenda AC10 devices in production, identify which are running firmware version 16.03.10.09_multi_TDE01, and immediately restrict web management access to LAN-only by disabling remote management or blocking inbound traffic to the management interface from the internet. Within 7 days: Implement network segmentation to isolate router administration traffic on a restricted VLAN, enable logging of all management interface access attempts, establish baseline monitoring for suspicious authentication patterns, and contact Tenda support to confirm whether any previous firmware versions prior to 16.03.10.09_multi_TDE01 are unaffected; if so, test and deploy the downgrade. Within 30 days: Either apply a vendor security patch when released (monitor Tenda advisory channels continuously) or execute a hardware replacement plan with an alternative vendor; configure replacement routers with mandatory network access controls and administrative interface restrictions.

Tenda AC10 CVE-2026-19924

Q: What is the CVSS score of CVE-2026-19924?

CVE-2026-19924 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-59835 HIGH

Improper Authentication (CWE-287)

2026-08-16 VulDB

GHSA-gmqq-p6mp-w5p6

Authentication Bypass Tenda Ac10

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network attack bypassing httpd authentication with full device-level confidentiality, integrity, and availability impact; scope unchanged as compromise is contained to the router.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 16, 2026 - 02:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 16, 2026 - 02:22 vuln.today

cvss_changed

Severity Changed

Aug 16, 2026 - 02:22 NVD

CRITICAL HIGH

CVSS changed

Aug 16, 2026 - 02:22 NVD

9.3 (CRITICAL) 8.9 (HIGH)

Analysis Generated

Aug 16, 2026 - 01:42 vuln.today

CVE Published

Aug 16, 2026 - 01:00 cve.org

CRITICAL 9.3

DescriptionCVE.org

A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Authentication bypass in Tenda AC10 firmware 16.03.10.09_multi_TDE01 allows unauthenticated remote attackers to circumvent the httpd web management interface's access controls via manipulation of the R7WebsSecurityHandler function. The vulnerability carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact against the vulnerable system. A publicly available proof-of-concept exploit has been published on GitHub, materially lowering the exploitation barrier and enabling opportunistic mass-targeting of exposed devices.

Technical ContextAI

The Tenda AC10 is a consumer and SOHO-grade WiFi router whose embedded web management interface is served by an httpd daemon. The vulnerable function R7WebsSecurityHandler is responsible for enforcing authentication on incoming HTTP requests to that management interface. CWE-287 (Improper Authentication) indicates the function fails to correctly verify requester identity - likely by mishandling request headers, session tokens, URL path checks, or method-level gating in a manner that permits complete bypass without credentials. The confirmed affected artifact is firmware version AC10 16.03.10.09_multi_TDE01, independently corroborated by ENISA EUVD-2026-59835. The NVD CPE identifier cpe:2.3:a:tenda:ac10:*:*:*:*:*:*:*:* uses a wildcard version field, which may indicate that the vulnerability class extends across multiple firmware builds, though only the single version above is explicitly confirmed. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N describes a network-reachable, zero-prerequisite, automated-exploitation-capable attack profile consistent with the improper authentication root cause.

RemediationAI

No vendor-released patch has been identified at time of analysis - Tenda has not published a security advisory or updated firmware addressing this CVE. The most effective immediate compensating control is to disable or firewall-block WAN-side access to the AC10's httpd management interface (typically TCP port 80 and 443), restricting it to LAN-only access; this eliminates the remote-network attack vector at the cost of losing remote administration capability. Where LAN-adjacent threat actors are also a concern, placing the management interface behind a dedicated management VLAN with strict ACLs further constrains the exposure surface. Administrators should avoid exposing the Tenda AC10 management interface via port-forwarding or DMZ configurations until a patched firmware is available. Monitor the Tenda official site at https://www.tenda.com.cn/ and the VulDB tracking record at https://vuldb.com/vuln/390174 for firmware updates. If device replacement is operationally feasible, prioritizing migration to actively maintained hardware should be evaluated given the absence of a vendor response.