CVE-2026-123966 is a heap-based buffer overflow in Tenda AC19 firmware 16.03.10.07 that can be triggered remotely. The exploit has been publicly disclosed.
What Is It
The flaw is in the saveParentControlInfo function, which handles requests to the /goform/saveParentControlInfo endpoint. When an attacker manipulates the deviceId argument, the function overflows a buffer on the heap. The weakness is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).
VulDB is the CNA and published the CVE on 2026-11-07. NVD has marked the record "Deferred," which means NVD has not done its own analysis yet.
Why It Matters
The CNA rates this CRITICAL under every CVSS version it scored. The CVSS 3.1 and 2.0 scores are the maximum 10.0:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity "Proof of Concept"
- CVSS 2.0: 10.0
These vectors mean the attack works over the network, has low complexity, and needs no privileges or user interaction. The CVSS 3.1 vector rates the potential impact on confidentiality, integrity and availability as High. Its scope change means the impact could reach beyond the vulnerable component. These are the CNA's severity ratings. They are not confirmed results from a real attack. The CVE description says the exploit "has been publicly disclosed and may be utilized," and the references link to a public write-up.
This CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation in the wild. Exposed devices should still be a priority because a public proof of concept exists.
What's Vulnerable
- Vendor: Tenda
- Product: AC19
- Affected version: 16.03.10.07
- CPE:
cpe:2.3:h:tenda:ac19:*:*:*:*:*:*:*:*
The supplied records do not list any other firmware versions.
Patch Status
The supplied KEV and NVD data does not mention a vendor patch, a fixed firmware version or an official advisory. The record is not in KEV, so CISA has set no required action or due date. The references include Tenda's main website but no specific security bulletin. Owners of AC19 devices running 16.03.10.07 should check Tenda for updated firmware and keep the device's management interface off untrusted networks.