CVE-2026-123966

Name of the Vulnerable Software and Affected Versions Tenda AC19 version 16.03.10.07

Description A heap-based buffer overflow occurs in the saveParentControlInfo() function within the /goform/saveParentControlInfo endpoint. This issue is triggered by the manipulation of the deviceId argument, allowing a remote attacker to execute arbitrary code and take control of the router without requiring authentication.

Recommendations Update the firmware for version 16.03.10.07. As a temporary workaround, restrict access to the /goform/saveParentControlInfo endpoint to minimize the risk of exploitation.