Tenda AC19: Stack-based buffer overflow in httpd web service (CVE-2026-113744)

A critical security vulnerability, CVE-2026-113744, has been identified in Tenda AC19 routers running firmware version 16.03.10.07. The vulnerability exists within the httpd Web Management Service, specifically in the formSetFirewallCfg function located in the /goform/SetFirewallCfg file. An attacker can exploit this remotely by sending a maliciously crafted HTTP request containing an oversized payload within the 'firewallEn' parameter. This manipulation results in a stack-based buffer overflow, which can lead to a denial-of-service condition or potential arbitrary code execution with the privileges of the web service. As this service is internet-facing by design and public exploit code is available, the risk to affected devices is significant.

Impact

Successful exploitation of this vulnerability allows for unauthenticated remote code execution or a persistent denial-of-service state on the affected Tenda AC19 routers. This compromises the integrity and availability of the local network perimeter, as the device acts as the primary gateway. Targeted organizations using this hardware model in remote offices or small business environments are at high risk of unauthorized access.

Recommendation

1. Review internal inventory to identify any Tenda AC19 devices running firmware version 16.03.10.07.
2. If an official firmware patch is provided by Tenda, apply it immediately across the entire fleet of identified devices.
3. In the absence of an immediate patch, restrict access to the web management interface of the router to trusted internal IP addresses only.
4. Ensure that the web management service is not exposed to the public internet by disabling remote administration features.
5. Monitor perimeter firewall logs for unusual POST requests targeting the /goform/SetFirewallCfg endpoint.