CVE-2026-123966: Remote Buffer Overflow in Tenda AC19

Critical buffer overflow in Tenda AC19 router. Unauthenticated remote attack.

CVE-2026-123966 is a heap-based buffer overflow vulnerability in Tenda AC19 router version 16.03.10.07. The flaw resides in the saveParentControlInfo function of the remote endpoint /goform/saveParentControlInfo. An unauthenticated attacker can manipulate the deviceId parameter to cause heap memory overflow. This directly exposes home and enterprise networks using this router model.

The vulnerability severity is at maximum: CVSS 10.0, the highest critical score. Official NVD description confirms the exploit has been publicly disclosed and can be used by anyone. Social signals from recent days (4 posts in 24 hours, 30 total interactions) document widespread awareness and proof-of-concept availability. Risk of active exploitation is immediate.

IT administrators and CISOs must urgently contact Tenda support for patch availability. While awaiting fix, implement restrictions on remote access to the router, disable unnecessary services and actively monitor traffic to /goform/saveParentControlInfo. As soon as firmware updates become available, test them in lab and deploy without delay.

At a glance

What: Heap-based buffer overflow in saveParentControlInfo function (/goform/saveParentControlInfo) in Tenda AC19 16.03.10.07. Unvalidated manipulation of deviceId parameter enables unauthenticated remote code execution.
Severity: CVSS 10.0 - critical. Maximum impact on confidentiality, integrity and availability of router and network.
Affected versions: Tenda AC19 16.03.10.07
Fix: Not reported
Status: Publicly disclosed exploit according to NVD. Vulnerability confirmed and active. Widespread awareness on social networks (4 posts in 24 hours).
Action: Contact Tenda support for patch availability. Restrict remote access to router, monitor traffic to /goform/saveParentControlInfo endpoint. Deploy firmware updates immediately when available.

Sources: NVD, CVE-2026-123966

← All articles