CVE-2026-113744: Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction. Exploitation targets the httpd web management service through the firewallEn argument handled by /goform/SetFirewallCfg.
How serious is successful exploitation?
The supplied severity vector rates the issue as critical, with high impacts to confidentiality, integrity, and availability. The scope is also marked as changed.
Is exploit code available?
Yes. The exploit has been publicly disclosed and may be used.