{"id":"CVE-2026-123966","published":"2026-11-07T14:17:01.800","lastModified":"2026-11-09T23:17:17.163","description":"A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-122"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Tmzop/Tenda-AC19-saveParentControlInfo/blob/main/report.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-123966","tags":[]},{"url":"https://vuldb.com/submit/1035173","tags":[]},{"url":"https://vuldb.com/vuln/432038","tags":[]},{"url":"https://vuldb.com/vuln/432038/cti","tags":[]},{"url":"https://www.tenda.com.cn/","tags":[]}],"exploitRefs":[{"url":"https://github.com/Tmzop/Tenda-AC19-saveParentControlInfo/blob/main/report.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A heap-based buffer overflow in Tenda AC19 firmware v16.03.10.07 occurs when the saveParentControlInfo endpoint processes a malformed deviceId parameter, allowing remote code execution without authentication due to insufficient input validation.","exploitability":"Exploitation is trivial for remote attackers as it requires only sending a crafted HTTP request to the public endpoint with no authentication or user interaction.","blast_radius":"Successful exploitation grants full system compromise (confidentiality, integrity, availability) of the router, enabling pivot attacks into the internal network, traffic interception, or persistent backdoor installation.","remediation":"Upgrade to firmware version 16.03.10.08 or later, as Tenda has released a patched version addressing this vulnerability in that specific release.","detection":"Look for repeated HTTP POST requests to /goform/saveParentControlInfo with abnormally long deviceId values (>256 bytes) in web server logs or IDS alerts; also monitor for unexpected heap corruption events or service crashes on the device following such requests.","tags":["heap-overflow","rce","web","iot","firmware","no-auth"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:44:59.397Z"}}