Paper/Archive/CVE-2026-123966

CVE-2026-123966

Tenda AC19 — Tenda AC19 saveParentControlInfo heap-based overflow

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Affected

ProductAffectedFixed inSource

AC1916.03.10.07–CNA

Scores by source

VulDB (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

VulDB (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C

VulDB (CNA)10.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C

References

writeupvuldb.com/vuln/432038 refvuldb.com/vuln/432038/cti writeupvuldb.com/cve/CVE-2026-123966 writeupvuldb.com/submit/1035173 exploitgithub.com/Tmzop/Tenda-AC19-saveParentControlInfo/blob/main/report.md reftenda.com.cn