Zero Radar
← feed
CriticalVulnerabilityCVE-2026-113744updated 25 Oct 2026, 18:50 UTC

Tenda AC19 router web panel can be crashed or taken over remotely

Someone on the network can send a specially crafted request to the router's admin page and overwrite memory inside it. This can let them take control of the router, which sits at the edge of your network.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?Not knownNo attacks reported so far
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted request to the router's admin page
  2. 2Request reaches routerWeb management service accepts it
  3. 3Overflow in firewall handlerfirewallEn value overruns stack memory
  4. 4Router code hijackedAttacker runs commands on the device
  5. ResultAttacker controls the router

What happened

The formSetFirewallCfg handler at /goform/SetFirewallCfg in the httpd web management service of Tenda AC19 firmware 16.03.10.07 has a stack-based buffer overflow triggered by the firewallEn argument, and the attack can be launched remotely.

Why it is dangerous: A successful attack can give an attacker control over the router, letting them watch or redirect traffic and reach devices behind it. Anyone running this router with its management interface reachable is at risk.

Are you affected?

You are affected if you run a Tenda AC19 router on firmware 16.03.10.07 with its web management interface reachable from the network, including from the internet.

Tenda AC19, firmware 16.03.10.07

What to do

  1. Check whether your router runs Tenda AC19 firmware 16.03.10.07 and check the Tenda site for a newer firmware release.
  2. Turn off remote management so the admin page cannot be reached from the internet.
  3. Restrict access to the router's admin page to trusted devices on your local network only.
  4. Change the admin password to a strong unique one.

Timeline

  1. 21 Oct 2026, 02:17 UTC
    Publicly disclosed
  2. 21 Oct 2026, 02:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 18:50 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-113744 · GHSA-5w5f-rphr-2j3g
CVSS
9.3 / 10
EPSS
0.6% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 02:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 18:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Tenda AC19 router web panel can be crashed or taken over remotely · Zero Radar