EUVD-2026-107031
GHSA-5w5f-rphr-2j3g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web management interface
-
DeliverySend crafted POST to /goform/SetFirewallCfg
-
ExploitOverflow stack via oversized firewallEn
-
ExecutionOverwrite return address / control flow
-
PersistExecute code or crash httpd
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to reach the Tenda AC19 httpd web management interface and issue a request to /goform/SetFirewallCfg with an overlong firewallEn argument. The exploit targets firmware version 16.03.10.07 specifically. Key limiting factors: the management interface is LAN-facing by default and is only exposed to the Internet/WAN if remote administration is enabled, so realistic remote exploitation generally requires either a position on the local/guest network or a device with remote management turned on. The input CVSS asserts PR:N (no authentication), but Tenda goform endpoints frequently require a valid login session in default configurations - defenders should verify whether a session is needed on their firmware build. |
| Impact | Multiple signals align on elevated risk but with an important exposure caveat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated stack-based buffer overflow (CWE-121) in the Tenda AC19 httpd web management service, scored 9.3 CRITICAL. A public exploit is confirmed (CVSS E:P, 'Proof-of-Concept'), with exploit code hosted on GitHub (henrythekingofuk/TendaCVE), so publicly available exploit code exists. However, this is NOT confirmed actively exploited - the CVE is not listed in CISA KEV, and no EPSS probability was supplied in the input, so widespread opportunistic exploitation cannot be asserted. The dominant real-world limiter is reachability, not vulnerability: Tenda AC19 is a consumer/SOHO router whose web management interface is LAN-facing by default and only WAN-exposed when remote management is explicitly enabled. Therefore the signals are consistent (critical, unauthenticated RCE with a POC) but the practical priority is high only for devices whose management plane is reachable by the attacker (hostile LAN, guest network, or Internet-exposed admin). Note also that many Tenda /goform endpoints require an authenticated session in default configurations; the input vector asserts PR:N, so no authentication qualifier is downgraded here, but this should be verified against the device's default auth behavior. |
| Exploit ScenarioDerived | An attacker with network access to the router's web management interface sends a crafted HTTP request to /goform/SetFirewallCfg containing an oversized firewallEn parameter, overflowing a stack buffer in the formSetFirewallCfg function of httpd. This corrupts the stack and allows execution of attacker-controlled code or a crash of the management daemon; a public proof-of-concept is available on GitHub, lowering the skill needed to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 21, 2026
A stack-based buffer overflow in the formSetFirewallCfg handler of the Tenda AC19 router's httpd web management service lets a remote attacker crash or potentially execute code on the device by sending an overlong firewallEn parameter to /goform/SetFirewallCfg. The issue is confirmed against firmware 16.03.10.07 and carries a 9.3 CVSS v4 score with a PR:N vector, meaning no authentication is asserted as a prerequisite, although Tenda goform endpoints commonly enforce a session on default builds and the independent assessment flags this as unverified. Publicly available exploit code exists (a GitHub PoC repository is linked from the CVE record), which raises the likelihood of opportunistic attempts against any AC19 whose management interface is reachable.
Earlier versions of this analysis (1)
Stack-based buffer overflow in Tenda AC19 firmware 16.03.10.07 lets remote attackers who can reach the httpd Web Management Service trigger memory corruption by POSTing an oversized firewallEn value to /goform/SetFirewallCfg; publicly available exploit code exists. The CVSS v4.0 score is 10.0 and the independent assessment rates confidentiality, integrity, and availability impact as high, with no authentication or user interaction required by the vector. Practical risk is constrained by exposure: the management interface is typically LAN-bound, so WAN exploitation depends on remote management being enabled or prior LAN access.
RemediationAI
No vendor-released patch or fixed firmware version was identified at time of analysis, so mitigation must be exposure-based until Tenda ships an update (monitor https://www.tenda.com.cn/ and the VulDB entry https://vuldb.com/vuln/422925 for a fixed build). First and most effective: disable remote/WAN administration and keep the AC19 management interface bound to the LAN side only, since the attack requires reaching /goform/SetFirewallCfg - this removes internet-facing exposure entirely but does not protect against attackers already on the LAN or guest network. Second: restrict the management UI to a dedicated admin VLAN or a small allow-list of source IPs via the router's access-control or firewall rules, accepting the operational cost of jump-host access for administrators. Third: on managed networks, block POST requests to /goform/SetFirewallCfg at an upstream proxy or IPS and alert on anomalous firewallEn payload lengths, though this is signature-dependent and easily bypassed by encoding variations. Fourth: treat the device as untrusted - segment it away from sensitive systems, disable WPS/UPnP and unused services, and rotate any credentials stored on the router, because a successful overflow can yield code execution as the httpd user (commonly root). Replace the unit with a vendor-supported model if Tenda does not issue firmware; consumer routers past end-of-support rarely receive fixes for this class of bug.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda AC19 is a consumer dual-band Wi-Fi router whose administrative UI is served by an embedded httpd daemon exposing goform-style CGI handlers. In CVE-2026-113744, the formSetFirewallCfg function in /goform/SetFirewallCfg copies the user-supplied firewallEn parameter into a fixed-size stack buffer without validating length, the classic CWE-121 stack-based buffer overflow pattern. Because the overflow occurs on the stack, an attacker who can shape the payload can overwrite saved registers and the return address, giving at minimum a denial-of-service crash of httpd and potentially arbitrary code execution in the context of the daemon (typically root on embedded router firmware). The CPE string cpe:2.3:a:tenda:ac19:*:*:*:*:*:*:*:* is unversioned, so it nominally matches all AC19 builds, but only firmware 16.03.10.07 is confirmed by the reporter (VulDB, submission 1018542). No CWE-121-specific mitigations such as stack canaries or full ASLR can be assumed on this class of firmware, which is why the CVSS v4 vector asserts high confidentiality, integrity, and availability impact across both the vulnerable system and subsequent systems.
Know when Ac19 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable httpd endpoint, low-complexity single-parameter overflow with no UI; PR:N per input vector; code execution on the device yields full C/I/A, scope unchanged within the device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Technical POC Analysis
The defect is a stack-based buffer overflow, CWE-121, in formSetFirewallCfg, the handler for /goform/SetFirewallCfg in the Tenda AC19 httpd web management service.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Tenda AC19 routers running firmware 16.03.10.07 carry a critical web-management flaw, and publicly available exploit code exists while no vendor-released patch was identified at time of analysis. Devices with management interfaces reachable from untrusted networks could be crashed or compromised, potentially disrupting connectivity or giving an attacker a foothold into the local network. Leadership should treat exposure as time-sensitive and direct teams to locate, restrict, and isolate affected routers until vendor remediation is available.
Restrict the AC19 web management interface and /goform/SetFirewallCfg to trusted management networks or VPN, disable WAN-side administration, segment affected routers from critical assets, monitor for malformed firewallEn requests and device crashes, and replace or isolate devices until vendor firmware is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB