CVE-2026-113744 is a remotely exploitable stack-based buffer overflow in the Tenda AC19 router's web management service, rated critical, and a public exploit has been disclosed for it.
What Is It
CVE-2026-113744 affects the formSetFirewallCfg function in the /goform/SetFirewallCfg endpoint of the httpd Web Management Service on Tenda AC19 firmware 16.03.10.07. A manipulated firewallEn argument causes a stack-based buffer overflow. The CNA (VulDB) classifies the weakness as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
The record was published to NVD on 2026-10-21 and is still in "Received" status, so NVD has not yet completed its own analysis.
Why It Matters
VulDB rates this flaw at the top of the severity scale:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with Exploit Maturity set to Proof-of-Concept
- CVSS 2.0: 10.0
The vectors describe an attack that works over the network, is low in complexity, and needs no privileges or user interaction. It has high impact on confidentiality, integrity, and availability. According to the NVD description, "the exploit has been disclosed publicly and may be used," and a public GitHub repository is listed among the references.
KEV status: CVE-2026-113744 is not currently in the CISA Known Exploited Vulnerabilities catalog. A public proof-of-concept exists, but the supplied data does not confirm exploitation in the wild.
What's Vulnerable
- Vendor: Tenda
- Product: AC19
- Affected version: 16.03.10.07
- Component: httpd Web Management Service (
/goform/SetFirewallCfg) - CPE:
cpe:2.3:h:tenda:ac19:*:*:*:*:*:*:*:*
The record lists only firmware 16.03.10.07 as affected. It does not say whether other versions were tested.
Patch Status
The NVD record does not mention a vendor patch, a fixed firmware version, or a vendor advisory. CISA has not issued a required action because the CVE is not in KEV. Tenda's website is listed as a reference, but the supplied data does not confirm that a fix exists. Owners of affected AC19 devices should check Tenda directly for updated firmware.