Public exploit targets Tenda AC19 router firmware for remote control

Attackers can remotely target Tenda AC19 routers running firmware version 16.03.10.07. The vulnerability involves a stack-based buffer overflow in the web management service. Because the exploit has been disclosed publicly, it may be used by threat actors. This allows remote manipulation of the device. The National Vulnerability Database rates the issue as critical. The flaw is in the function formSetFirewallCfg within the /goform/SetFirewallCfg file.

In plain English

The issue involves a specific part of the router’s web management interface. When users configure firewall settings, the router processes that input through a function called formSetFirewallCfg. The code handling the firewallEn argument does not properly check the size of the data it receives. If an attacker sends a specially crafted request that is larger than expected, it overflows the stack memory. This overflow leads to a stack-based buffer overflow.

The background

The National Vulnerability Database lists this issue as CVE-2026-113744. It is rated as critical, with CVSS scores of 10 and 9.3 reported in different records. The weakness is classified under CWE-121 and CWE-119, which relate to buffer overflows and improper restrictions. The flaw affects the httpd component of the Tenda AC19. The affected firmware version is 16.03.10.07. The exploit has been made public, meaning anyone can access the code needed to trigger the overflow.

What changes now

Security teams must immediately identify any Tenda AC19 devices running the vulnerable firmware. Since the exploit is public, the risk of automated scanning and exploitation is high. Organizations should isolate these devices from the internet if possible. Users should check for any official statements from Tenda regarding a fix. Until a patch is confirmed, the only safe option is to restrict access to the device’s management interface or disconnect it from the network entirely.

What made it possible

Buffer overflows occur when software writes more data to a memory buffer than it can hold. Attackers exploit this by crafting inputs that spill over into adjacent memory spaces. This technique often serves as an initial foothold in an intrusion, allowing remote code execution. Teams usually monitor for unusual traffic patterns on management ports. Check whether input validation is enforced on all web-facing configuration endpoints. Ensure that default credentials are changed to reduce the attack surface. Review firewall logs for signs of malformed requests that might indicate an attempt to trigger this type of memory corruption.

Background: Default credentials

Default credentials are the factory-set usernames and passwords that come pre-installed on devices. Attackers use automated tools to test these known combinations. You must change them immediately upon setup to prevent unauthorized access to your network and data.

Read the full guide: Default Credentials: Why Factory Settings Invite Intruders

What to do and how to stay safe: Tenda

• Identify all Tenda AC19 routers on your network and verify their firmware version.
• Isolate devices running firmware 16.03.10.07 from external internet access immediately.
• Monitor network logs for unusual traffic targeting the router's web management port.
• Wait for an official vendor update before reconnecting isolated devices to the internet.

Step-by-step guide: Implement Firewalls: A Step-by-Step Guide for Network Security

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is there a patch available for CVE-2026-113744?

No fix has been confirmed yet by the vendor.

Which firmware version is affected?

Tenda AC19 firmware version 16.03.10.07 is affected.

Can this be exploited remotely?

Yes, the attack may be launched remotely.