{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ac19-16.03.10.07/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:tenda:ac19_firmware:16.03.10.07:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-113744"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AC19 (16.03.10.07)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-113744","buffer-overflow","router-vulnerability","rce"],"_cs_type":"advisory","_cs_vendors":["Tenda"],"content_html":"\u003cp\u003eA critical security vulnerability, CVE-2026-113744, has been identified in Tenda AC19 routers running firmware version 16.03.10.07. The vulnerability exists within the httpd Web Management Service, specifically in the formSetFirewallCfg function located in the /goform/SetFirewallCfg file. An attacker can exploit this remotely by sending a maliciously crafted HTTP request containing an oversized payload within the 'firewallEn' parameter. This manipulation results in a stack-based buffer overflow, which can lead to a denial-of-service condition or potential arbitrary code execution with the privileges of the web service. As this service is internet-facing by design and public exploit code is available, the risk to affected devices is significant.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows for unauthenticated remote code execution or a persistent denial-of-service state on the affected Tenda AC19 routers. This compromises the integrity and availability of the local network perimeter, as the device acts as the primary gateway. Targeted organizations using this hardware model in remote offices or small business environments are at high risk of unauthorized access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eReview internal inventory to identify any Tenda AC19 devices running firmware version 16.03.10.07.\u003c/li\u003e\n\u003cli\u003eIf an official firmware patch is provided by Tenda, apply it immediately across the entire fleet of identified devices.\u003c/li\u003e\n\u003cli\u003eIn the absence of an immediate patch, restrict access to the web management interface of the router to trusted internal IP addresses only.\u003c/li\u003e\n\u003cli\u003eEnsure that the web management service is not exposed to the public internet by disabling remote administration features.\u003c/li\u003e\n\u003cli\u003eMonitor perimeter firewall logs for unusual POST requests targeting the /goform/SetFirewallCfg endpoint.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-21T04:16:27Z","date_published":"2026-10-21T04:16:27Z","id":"https://feed.craftedsignal.io/briefs/2026-10-tenda-ac19-buffer-overflow/","summary":"Tenda AC19 firmware version 16.03.10.07 is vulnerable to a remote stack-based buffer overflow in the httpd web management service, allowing unauthenticated attackers to trigger a crash or achieve arbitrary code execution via the firewallEn parameter.","title":"Tenda AC19: Stack-based buffer overflow in httpd web service (CVE-2026-113744)","url":"https://feed.craftedsignal.io/briefs/2026-10-tenda-ac19-buffer-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - AC19 (16.03.10.07)","version":"https://jsonfeed.org/version/1.1"}