Brief Summary: Tenda AC19 CVE-2026-123966 Heap Buffer Overflow in saveParentControlInfo with Public PoC

Introduction

A single unauthenticated POST request to a Tenda AC19 router can take its web management service offline and force a reboot. The request needs no credentials and no user interaction. CVE-2026-123966 is a heap-based buffer overflow in the router's parental control endpoint, and a working proof of concept is already public.

Tenda, formally Shenzhen Tenda Technology Co., Ltd., is a Shenzhen-based networking vendor founded in 1999. It sells home and business networking gear, switches, gateways, powerline products, and IP cameras in more than 100 countries. The AC19 is one of its consumer dual-band gigabit Wi-Fi routers. These devices sit at the network edge and expose a web management interface, so memory safety flaws in that interface have direct availability consequences for the networks behind them.

Technical Information

The vulnerable operation is POST /goform/saveParentControlInfo, handled by the saveParentControlInfo function on the device's httpd web management interface. The researcher verified the issue on a Tenda AC19 Dual-Band Gigabit Wi-Fi Router running firmware V16.03.10.07, which the CVE record identifies as affected.

The root cause is a missing length check on the user-controlled deviceId parameter. The handler retrieves deviceId via websGetVar and copies it with strcpy into a buffer allocated by malloc(0x254u), which is 596 bytes, with no length validation or truncation. The decompiled sink reported by the researcher is:

ptr = (char *)malloc(0x254u);   // 596-byte heap buffer
memset(ptr, 0, 0x254u);
strcpy(ptr + 2, src);           // unsafe copy of attacker-controlled deviceId

An overlong deviceId overruns the allocation and corrupts adjacent heap metadata. This is the CWE-122 heap-based buffer overflow mechanism, classified alongside the broader CWE-119 improper restriction of operations within the bounds of a memory buffer.

The same unauthenticated request also reaches two more unchecked copies in the handler's callees, which broaden the endpoint's memory safety concerns:

• compare_parentcontrol_time reads the time parameter and feeds it to sscanf(s, "%[^-]-%s", v3, v11), where v3 and v11 are 4-byte stack buffers with no field-width limits, producing a stack overflow.
• get_parentControl_list_Info reads the urls parameter and copies it via strcpy((char *)(s + 80), v8) without length checking.

These observations should not be silently treated as separately assigned vulnerabilities, but they help explain why the published reproducer enlarges all three fields.

One aggravating factor is that the httpd process runs as root, so any memory corruption happens in a high-privilege context.

Attack Flow

1. The attacker reaches the AC19 web management interface, by default at http://192.168.0.1.
2. The attacker sends a single crafted POST request to /goform/saveParentControlInfo with oversized (around 600-byte) deviceId, time, and urls values.
3. The oversized deviceId overruns the 596-byte heap buffer, corrupting adjacent heap metadata.
4. The httpd service crashes and the device reboots. The management interface becomes temporarily unreachable and the browser reports ERR_NETWORK_CHANGED.

No authentication or user interaction is required at any step. The researcher discusses possible remote code execution as a consequence of controlled heap corruption, but the published evidence demonstrates denial of service rather than a working code execution chain.

Severity Scoring

The scoring sources should be kept distinct rather than flattened into one interchangeable number. The CVE record reports a CVSS 3.1 base score of 10.0 Critical with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C, indicating network access, low complexity, no privileges, and no user interaction, with high modeled confidentiality, integrity, and availability impact. VulDB lists a CVSS v3 base of 10.0 and a temporal score of 9.4, and NVD displays a VulDB CVSS 4.0 BT score of 9.3 Critical with the NIST assessment marked N/A. Neither the 10.0 nor the 9.3 should be attributed to an independent NIST assessment. The modeled severity is broader than the outcome the reproducer demonstrates, which is a crash and reboot.

Proof of Concept

A public, working proof of concept exists. NVD confirms the exploit has been publicly disclosed and may be utilized, and VulDB classifies the exploit maturity as Proof-of-Concept with the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/...E:P, scored 9.3 Critical.

The reproduction steps from the PoC report are:

1. Connect to the Tenda AC19 web management interface (default http://192.168.0.1).
2. Send a crafted POST to /goform/saveParentControlInfo with oversized (around 600-byte) deviceId, time, and urls values.
3. Observe the httpd service crash and device reboot. The web interface becomes temporarily unreachable, with the browser reporting ERR_NETWORK_CHANGED.

The published Python proof of concept:

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import requests

try:
    r = requests.post("http://192.168.0.1/goform/saveParentControlInfo",
                      data='deviceId=' + 'A'*600 + '&time=' + 'A'*600 + '&urls=' + 'A'*600,
                      headers={"Content-Type": "application/x-www-form-urlencoded"}, timeout=10)
    print(r.status_code, r.text[:200])
    requests.get("http://192.168.0.1/", timeout=5)
    print("service alive")
except:
    print("!! service unreachable, suspected crash/DoS")

The original PoC hardcodes literal 600-character A strings for each of the three parameters. The form above is an equivalent condensed representation of the same payload. The code was reviewed from the researcher's GitHub report but was not independently executed in this assessment. The evidence supports a verified unauthenticated crash and denial of service rather than demonstrated reliable code execution.

Affected Systems and Versions

• Product: Tenda AC19 Dual-Band Gigabit Wi-Fi Router
• Affected firmware: V16.03.10.07 (verified vulnerable)

The CVE record identifies V16.03.10.07 as affected but does not establish a complete range of other affected or unaffected releases. The official Tenda download page offers V16.03.10.07 (dated December 20, 2021, listed size 7.31 M), which is the same affected version, so that download does not constitute remediation. Tenda's installation notes state the package is only for AC19 v1.0 with existing firmware V16.03.10.XX or later, and explicitly warn not to upgrade to V16.03.10.09 because it can prevent configuration changes and may damage the router. A numerically higher version cannot be assumed safe on that basis alone, and no confirmed fixed release is identified in the available material.

Vendor Security History

Tenda's security track record includes CVE-2020-10987, which CISA lists for the Tenda AC1900 Router AC15 model. CISA describes remote system command execution through the deviceName POST parameter and classifies the issue under CWE-78. That is a different model, parameter, and vulnerability mechanism from the current AC19 heap overflow. CISA added the AC15 issue to its Known Exploited Vulnerabilities Catalog on November 3, 2021, with a remediation due date of May 3, 2022, and the entry does not name a threat actor and marks ransomware use as unknown. The AC15 case shows that at least one earlier Tenda router vulnerability has recognized exploitation history, but it does not establish active exploitation of CVE-2026-123966, a common actor across both issues, or a company-wide patch response rate.

References

• NVD: CVE-2026-123966
• CVE Record: CVE-2026-123966
• VulDB: Tenda AC19 saveParentControlInfo heap-based overflow
• VulDB CVE entry
• VulDB submission 1035173
• VulDB CTI data
• Researcher report (Tmzop GitHub)
• Researcher report (raw markdown)
• StackFlag advisory
• Tenda AC19 v1.0 Firmware page
• Tenda company profile (Global)
• Tenda company profile (CN)
• CISA Known Exploited Vulnerabilities Catalog
• CISA KEV entry for CVE-2020-10987 (AC15)