CVE-2026-19788: Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name stack-based overflow
A vulnerability was found in Tenda AC1206 15.03.06.23multiTD01. This affects the function setdevicename of the file /goform/SetOnlineDevName of the component httpd web management interface. The manipulation of the argument devName results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19788?
CVE-2026-19788 has a high severity rating of 8.8.
How do I fix CVE-2026-19788?
Fixing CVE-2026-19788 involves applying the latest firmware update provided by Tenda for the AC1206 device.
What impact does CVE-2026-19788 have on Tenda AC1206?
CVE-2026-19788 can lead to potential execution of arbitrary code due to a stack-based buffer overflow in the web management interface.
Is CVE-2026-19788 easily exploitable?
CVE-2026-19788 is considered moderately exploitable as it requires user interaction and network access.
What kind of attack can be performed using CVE-2026-19788?
An attacker can perform a stack-based overflow by manipulating the devName argument in the SetOnlineDevName function.