CVE-2026-123966: Tenda AC19 Heap Overflow
Critical CVSS (10.0) reachable over network.
TL;DR - CVE-2026-123966 is a critical heap-based buffer overflow affecting Tenda AC19 firmware
16.03.10.07. - NVD assigns the vulnerability a CVSS v3 base score of 10.0. - Public technical disclosure exists, but confirmed exploitation in the wild has not been established. - Restrict router administration immediately, check Tenda’s official support channels for a fix, and isolate or replace the device if no supported patch is available.
CVE-2026-123966 is a critical Tenda AC19 vulnerability involving the saveParentControlInfo handler and the /goform/saveParentControlInfo web-form endpoint. The issue affects firmware version 16.03.10.07, according to the reviewed vulnerability record. Administrators should treat exposed or unsupported routers as a priority because this heap-based buffer overflow may allow memory corruption and potentially serious compromise.
Vulnerability at a Glance
CVE-2026-123966 affects the Tenda AC19 wireless router. The issue is in the saveParentControlInfo function, which processes the deviceId argument received by the /goform/saveParentControlInfo endpoint. NVD assigns the vulnerability a critical CVSS v3 base score of 10.0.
The available record identifies firmware version 16.03.10.07 as affected. It does not establish whether other AC19 firmware versions are vulnerable, and no vendor-confirmed fixed version was identified in the reviewed sources.
| Field | Assessment |
|---|---|
| CVE ID | CVE-2026-123966 |
| CVSS score | 10.0, CVSS v3 |
| Attack vector | Remote |
| Authentication required | Unknown from the reviewed record |
| Privileges required | Unknown from the reviewed record |
| Affected product | Tenda AC19 wireless router |
| Affected version identified | 16.03.10.07 |
| Vulnerability type | Heap-based buffer overflow |
| Affected endpoint | /goform/saveParentControlInfo |
| Patch available | No confirmed vendor patch identified |
| Public disclosure | Yes |
| Confirmed exploitation in the wild | Not established |
| CISA KEV status | Not listed |
The missing authentication and privilege details matter operationally. NVD describes the attack as remote, but the supplied record does not provide the complete CVSS vector or clarify whether an attacker must first authenticate to the router’s management interface. Defenders should not assume that authentication is required or that Internet exposure is the only relevant scenario.
Analyst’s Take: The immediate priority is exposure reduction, not waiting for confirmation of in-the-wild exploitation. The record combines a CVSS 10.0 rating, remote reachability, public disclosure, and no confirmed vendor patch, while leaving authentication requirements unresolved.
What Is This Vulnerability?
The flaw is a heap-based buffer overflow in saveParentControlInfo, a handler associated with Tenda’s parental-control functionality. The handler processes the deviceId parameter submitted to /goform/saveParentControlInfo. According to the NVD description, manipulating this argument causes memory to be written beyond the intended heap allocation.
Heap corruption can produce several outcomes, including a process crash, denial of service, corruption of adjacent data, or potentially code execution. The available material does not establish the exact overwrite primitive, whether modern mitigations are enabled, or whether a reliable remote code-execution chain exists. Treat the issue as potentially capable of serious compromise without claiming confirmed code execution.
The endpoint appears to be part of the router’s HTTP administration interface. If that interface is exposed to the Internet, an attacker may be able to send malicious requests directly. The same risk can apply when the management interface is reachable from an untrusted internal segment, guest network, compromised endpoint, or wireless network. Evaluate remote reachability across all network paths, not only the WAN interface.
Technical Details
The vulnerable request is associated with the following path and parameter:
POST /goform/saveParentControlInfo
deviceId=<attacker-controlled-value>
The specific request method, required headers, authentication state, payload length, and exploit reliability were not independently confirmed from the available public material. Do not deploy an unverified proof of concept against production routers. Use an isolated lab device or firmware image for validation.
Who Is Affected?
The affected product identified by the NVD record is the Tenda AC19 wireless router, with firmware version 16.03.10.07 specifically named. No additional AC19 version range was provided. The currently supportable statement is therefore narrower than “all AC19 devices”: firmware 16.03.10.07 is affected, while the status of earlier and later versions remains unknown.
| Product | Affected version identified | Fixed version |
|---|---|---|
| Tenda AC19 | 16.03.10.07 |
Not identified |
Administrators should inventory both the hardware model and firmware version. Do not rely solely on a device’s model name because regional variants, vendor revisions, and firmware branches can differ. If an AC19 reports a version other than 16.03.10.07, that does not prove safety; it means only that the reviewed record does not confirm its status.
No Tenda advisory specifically confirming a fix for this CVE was identified in the supplied research. Tenda end-of-life information also makes lifecycle status a key consideration. If the device is unsupported or cannot receive a security update, replacement is the safest long-term response rather than indefinite reliance on network controls.
For broader guidance on router remediation and vulnerability prioritization, see our Nessus Essentials vs. Professional comparison.
CVSS Score Breakdown
NVD assigns CVE-2026-123966 a CVSS v3 base score of 10.0, the maximum severity rating. The score reflects the description of a remotely reachable vulnerability with potentially severe impact. However, the complete CVSS vector was not included in the reviewed NVD record, so the individual metric values cannot be stated reliably.
The available data supports the following interpretation:
| CVSS-related factor | Available assessment |
|---|---|
| Attack vector | Remote |
| Attack complexity | Not provided |
| Privileges required | Not provided |
| User interaction | Not provided |
| Scope | Not provided |
| Confidentiality impact | Not provided |
| Integrity impact | Not provided |
| Availability impact | Not provided |
| Base score | 10.0 |
The absence of the full vector limits precise risk modeling. Security teams should not reverse-engineer the missing values from the score or assume that the record proves unauthenticated Internet exploitation. Use the confirmed facts—remote reachability, heap corruption, public disclosure, and the critical base score—to prioritize exposure reduction and device remediation.
For prioritization, a router vulnerable to memory corruption should be treated as a high-impact network control-plane risk. Compromise could enable traffic interception, configuration tampering, credential exposure, persistence, or disruption, although none of those outcomes has been confirmed for this specific CVE.
Exploitation Status
NVD states that the exploit has been publicly disclosed and may be utilized. A public GitHub repository, Tmzop/Tenda-AC19-saveParentControlInfo, contains a report for the issue. This establishes public technical disclosure and a public reference, but it does not by itself prove that a weaponized exploit is broadly available or that exploitation is occurring at scale.
The reviewed material does not establish confirmed exploitation in the wild. CVE-2026-123966 is also not listed in the CISA Known Exploited Vulnerabilities catalog. There is therefore no CISA KEV date added, due date, required action, or ransomware-campaign designation applicable to this CVE at the time of assessment.
| Exploitation indicator | Status |
|---|---|
| Public disclosure | Confirmed |
| Public GitHub reference | Confirmed |
| Reliable public proof-of-concept steps | Not independently verified |
| Confirmed weaponized exploit | Not established |
| Confirmed exploitation in the wild | Not established |
| CISA KEV listing | No |
The lack of KEV inclusion does not show that exploitation is impossible or absent. KEV is a catalog of vulnerabilities CISA has confirmed or assessed as exploited; it is not a complete sensor network for every vulnerable device. Internet-exposed routers should be treated as higher risk because scanning and opportunistic exploitation can occur before a vulnerability receives broader reporting.
How to Detect It
Detection should begin with asset inventory and exposure analysis. Identify every Tenda AC19 device, record its firmware version, and determine whether its administrative interface is reachable from the WAN, guest networks, wireless client networks, or other untrusted segments. A device running 16.03.10.07 should be escalated for immediate mitigation.
Review router HTTP logs, reverse-proxy logs, firewall telemetry, and network captures for requests to /goform/saveParentControlInfo. Pay particular attention to unusual deviceId values, excessive parameter lengths, repeated requests, malformed requests, unexpected source addresses, and router restarts or configuration changes following such requests. Exact log formats vary by firmware, and the available record does not provide a vendor-specific event ID.
Example Log Search
A generic web-log search can identify requests to the affected handler:
grep -E '(/goform/saveParentControlInfo|deviceId=)' /var/log/nginx/access.log \
/var/log/httpd/access_log 2>/dev/null
For normalized web telemetry, a Splunk-style query might look like this:
index=web
(uri_path="/goform/saveParentControlInfo" OR uri_query="*deviceId=*")
| stats count values(src_ip) values(http_user_agent)
by dest_ip, uri_path, status
| sort - count
A request containing an unusually long parameter should be investigated, but length alone is not proof of exploitation. If raw request data is available, preserve it for analysis without replaying the payload against a production router.
Network monitoring can also alert on the path when the router’s management interface is expected to be reachable only from a trusted administration subnet:
alert http any any -> $HOME_NET any (
msg:"Tenda AC19 saveParentControlInfo access";
flow:to_server,established;
http.uri;
content:"/goform/saveParentControlInfo";
nocase;
classtype:attempted-admin;
sid:4200123966;
rev:1;
)
The rule is a visibility control, not proof of malicious activity. Tune $HOME_NET and deployment direction for the local environment, then correlate alerts with source address, authentication events, firmware version, process crashes, reboots, and configuration changes.
Mitigation and Patching
No vendor-confirmed fixed version was identified in the reviewed references. The specific affected firmware version is 16.03.10.07; the fixed version is therefore not identified. Administrators should check Tenda’s official AC19 support and download channels directly, verify the firmware image and release notes, and confirm that any newer release explicitly addresses this vulnerability or provides a security-relevant fix.
Until a fix is confirmed, remove Internet exposure from the router’s management interface. Disable remote administration if it is not required, restrict administration to a dedicated management VLAN or trusted host range, and prevent guest or untrusted wireless clients from reaching the management service. These controls reduce attack surface but do not remove the underlying memory-corruption flaw.
If the device cannot be patched, isolate it behind a firewall with tightly limited management access and plan replacement. This is especially important for unsupported or end-of-life hardware. If compromise is suspected, preserve available logs, disconnect or isolate the router, reset administrative credentials from a trusted system, review DNS and network settings, and replace the device when firmware integrity cannot be established.
Firmware Update Checklist
Because no confirmed fixed version was identified, do not use an invented version in an automated upgrade policy. First inspect the installed firmware and then apply only a firmware image obtained from an official Tenda channel:
1. Log in from a trusted management host.
2. Record the current model, hardware revision, and firmware version.
3. Download the matching AC19 firmware from Tenda's official support channel.
4. Verify the release notes and image integrity where verification material is provided.
5. Back up configuration only if the backup can be handled securely.
6. Upgrade during a controlled maintenance window.
7. Confirm the resulting firmware version and disable WAN administration.
For devices managed through a firewall, a temporary policy should permit the management service only from an approved administration network. The exact service ports depend on the local configuration, so the control should be based on the router’s actual management service rather than an assumed port:
ALLOW admin_vlan -> tenda_ac19_management_ip management_service
DENY any -> tenda_ac19_management_ip management_service
The allow rule must precede the deny rule, and the router should not be reachable through alternate paths such as port forwarding, UPnP-created mappings, guest Wi-Fi, or IPv6 exposure. If no supported firmware is available, the appropriate remediation is replacement or full isolation, not repeated resets.
Organizations managing credentials across network devices may also benefit from reviewing whether a password manager is necessary, particularly after rotating router administrator credentials.
References
The primary vulnerability record is the NVD entry for CVE-2026-123966:
The public technical reference is the GitHub repository associated with the issue:
Additional vulnerability database references include:
Tenda’s product end-of-life information is available at:
The reviewed sources do not identify a confirmed vendor patch, a fixed firmware version, or confirmed exploitation in the wild. Teams should recheck Tenda’s official support channels and the CISA KEV catalog for updates before closing the vulnerability record.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.