Tenda AC19 Web Service Suffers Critical Stack Overflow via Firewall Config Input on Firmware 16.03.10.07

A critical security flaw has been identified in the Tenda AC19 router. This issue affects devices running firmware version 16.03.10.07 and involves a remote stack-based buffer overflow.

What happened

The vulnerability resides within the httpd Web Management Service of the Tenda AC19. Specifically, the function formSetFirewallCfg in the file /goform/SetFirewallCfg is impacted. According to NVD records, manipulating the firewallEn argument leads to a stack-based buffer overflow. This manipulation can be launched remotely by an attacker.

The National Vulnerability Database assigns a CVSS score of 10.0 to CVE-2026-113744. Another NVD record lists the score as 9.3, both classified as critical. The weaknesses are mapped to CWE-121 and CWE-119. Exploit code for this issue has been disclosed publicly. The material states the exploit may be used. No vendor patch or fix has been confirmed in the source material.

Why it matters

Security teams must account for remote exposure in edge devices. The Tenda AC19 is a consumer-grade router often found in small office or home environments. A remote stack-based buffer overflow allows an attacker to execute arbitrary code. The public disclosure of exploit code increases the likelihood of automated scanning. Defence-in-depth strategies are essential for devices with known vulnerabilities. The absence of a confirmed patch leaves exposed systems at risk. Organisations using this firmware version should assess their network segmentation.

Next steps

• Isolate affected Tenda AC19 units from critical network segments.
• Monitor for unusual traffic to the web management service port.
• Review firewall logs for requests targeting the SetFirewallCfg endpoint.
• Prepare for a firmware update once the vendor releases a fix.

Detection notes

Teams usually observe anomalous traffic patterns when this type of activity occurs. Check whether the web server logs show unusually large POST requests to configuration endpoints. Look for crashes or reboots of the device following such requests. Inspect system logs for unexpected process terminations or memory access errors. Review network flows for connections from unknown external IPs to management interfaces. Containment moves typically involve blocking traffic to the vulnerable service. Verify that logging is enabled for all administrative actions. Ensure that intrusion detection signatures are updated to catch similar buffer overflow attempts.

Background: Firmware

You should enable firmware TPM if your hardware supports it and your operating system requires measured boot sequences. This setting activates a secure cryptographic processor embedded within your main system chipset rather than requiring an external microchip soldered to the motherboard.

Read the full guide: Should I enable firmware TPM and what breaks when you do

What to do and how to stay safe: Tenda AC19

• Segregate vulnerable routers from sensitive internal networks using VLANs.
• Restrict access to the web management interface to trusted IP addresses only.
• Monitor network traffic for signs of remote exploitation attempts.
• Await a vendor update to remediate the stack-based buffer overflow.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Tenda AC19 firmware version is affected by CVE-2026-113744?

Tenda AC19 firmware version 16.03.10.07 is affected by this vulnerability.

What is the root cause of the vulnerability?

The root cause is a stack-based buffer overflow in the formSetFirewallCfg function.

Is there a patch available for this vulnerability?

The source material does not state whether a patch or fix has been released.