Tenda AC19: Heap-based buffer overflow in saveParentControlInfo (CVE-2026-123966)
A heap-based buffer overflow vulnerability exists in Tenda AC19 firmware version 16.03.10.07, located in the saveParentControlInfo function within the /goform/saveParentControlInfo file.
CVE search metadata
CVE search record: CVE-2026-123966. Severity: critical. CVSS: 10.0. KEV: no. Product: AC19 (16.03.10.07). Brief: Tenda AC19: Heap-based buffer overflow in saveParentControlInfo (CVE-2026-123966). Brief link: https://feed.craftedsignal.io/briefs/2026-11-tenda-ac19-buffer-overflow/
Triage facts
Revision 1- Applicability
- AC19 (16.03.10.07)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 00:44 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability has been identified in Tenda AC19 (firmware 16.03.10.07). The function saveParentControlInfo in /goform/saveParentControlInfo is susceptible to a heap-based buffer overflow when the deviceId argument is manipulated. This attack can be performed remotely, and the exploit has been publicly disclosed.