Tenda AC19 Web Management Service Exposes Critical Remote Stack Buffer Overflow
Public exploit code targets a stack-based overflow in the Tenda AC19 firewall configuration endpoint, rated critical by the NVD.
Key points
- CVE-2026-113744 affects Tenda AC19 firmware version 16.03.10.07
- The flaw is a stack-based buffer overflow in the httpd Web Management Service
- Exploit code has been publicly disclosed and the attack can be launched remotely
The Tenda AC19 router firmware version 16.03.10.07 contains a critical remote vulnerability in its web management interface. Attackers can trigger a stack-based buffer overflow by manipulating the firewallEn argument in the SetFirewallCfg endpoint.
What happened
The National Vulnerability Database records CVE-2026-113744 as affecting the Tenda AC19 device running firmware version 16.03.10.07. The vulnerability resides within the httpd Web Management Service component, specifically in the /goform/SetFirewallCfg file. The affected function is named formSetFirewallCfg.
According to the NVD description, manipulating the argument firewallEn leads directly to a stack-based buffer overflow. This weakness is classified under CWE-121 and CWE-119. The attack vector is remote, meaning an attacker does not need physical access to the device to trigger the overflow condition.
The NVD rates the severity of CVE-2026-113744 as critical, with a CVSS score of 10 in one record and 9.3 in another. The description explicitly states that the exploit has been disclosed publicly. This public disclosure indicates that the code required to trigger the vulnerability is available for use.
Why it matters
Devices running the specific Tenda AC19 firmware version 16.03.10.07 are exposed to this remote exploitation risk. The presence of public exploit code significantly lowers the barrier for attackers to target these systems. The critical CVSS rating reflects the high potential impact of a successful stack-based buffer overflow.
Security teams should note that the vulnerability is located in the web management service. This component typically handles administrative configuration tasks. Remote access to this service, if exposed to untrusted networks, increases the attack surface.
What to watch
- Check network logs for unusual traffic targeting the /goform/SetFirewallCfg endpoint
- Monitor for connection attempts to the Tenda AC19 web management interface from unexpected sources
- Look for signs of service instability or crashes in the httpd component
- Verify that all Tenda AC19 devices are not running firmware version 16.03.10.07
Signals worth monitoring
Teams usually review web server access logs for requests containing unusually long or malformed parameters. They check whether the firewallEn argument contains values that exceed expected buffer sizes. Monitoring for sudden process terminations or segmentation faults in the httpd service can indicate a crash. Analysts also watch for anomalous outbound connections from the router, which may suggest command execution. Containment often involves isolating the affected device from the network to prevent further exploitation attempts.
Background: CVSS score
CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.
Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment
What to do and how to stay safe: Tenda AC19
- Verify if any Tenda AC19 devices in your environment are running firmware version 16.03.10.07
- Restrict access to the web management interface to trusted networks only
- Monitor for traffic targeting the SetFirewallCfg endpoint
- Once the vendor provides an update, apply it immediately to affected devices
General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific firmware version of the Tenda AC19 is affected by CVE-2026-113744?
The Tenda AC19 firmware version 16.03.10.07 is the affected version.
Is there a patch available for this vulnerability?
The source material does not confirm the availability of a patch or fix.
What is the severity rating of CVE-2026-113744?
The NVD rates the severity as critical, with CVSS scores of 10 and 9.3.
