Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-123966: Tenda AC19 router allows remote code execution via parental control
CVE-2026-123966 · published 3 days ago
Summary
The router’s parental‑control feature can be tricked into writing too much data into memory, which can let an attacker run their own code from a distance. This issue works over the network and has already been shown in the wild. Update the router firmware to the latest version or disable the parental‑control function until it is patched.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| tenda | ac19 | 16.03.10.07 |
Original advisory text
Tenda AC19 saveParentControlInfo heap-based overflow
A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.3
Critical
Type
CWE-122Heap-based Buffer Overflow
CWE-119Buffer Overflow
Timeline
Published7 Nov 2026
Updated10 Nov 2026
First seen7 Nov 2026
Track software like this
Free during beta