SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-19924 2026-08-16

CVE-2026-19924: Tenda AC10 Authentication Bypass in httpd Handler

"A critical, remotely exploitable improper-authentication flaw in the Tenda AC10 router's web server allows unauthenticated attackers to bypass authentication, with public exploit code already disclosed."

A critical, remotely exploitable improper-authentication flaw in the Tenda AC10 router's web server allows unauthenticated attackers to bypass authentication, with public exploit code already disclosed.

What Is It

CVE-2026-19924 is an improper authentication vulnerability (CWE-287) in the R7WebsSecurityHandler function of the httpd component in Tenda AC10 firmware version 16.03.10.09_multi_TDE01. Manipulation of the affected function leads to an authentication bypass. The attack can be initiated remotely, requires no privileges and no user interaction, and the exploit has been publicly disclosed and may be used in the wild.

The record was published on 2026-08-16 by VulDB ([email protected]) and is currently in Received status at NVD.

Why It Matters

The CVSS v3.1 base score is 9.8 (CRITICAL). The vector string carried alongside that score in the source record is internally inconsistent: it reads CVSS:4.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but the metrics it lists, including the scope metric S:U, belong to CVSS v3.1 and do not exist in v4.0. Read as a v3.1 vector, it is consistent with the 9.8 rating: network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact to confidentiality, integrity, and availability. The CVSS:4.0 prefix should be treated as a labeling error in the published data, not as a distinct v4.0 assessment.

The separate CVSS v4.0 assessment scores 8.9 (HIGH) and flags exploit maturity as PROOF_OF_CONCEPT, meaning working exploit material exists. The legacy CVSS v2 score is a maximum 10.0 with complete impact across all three properties.

Because the flaw sits in the router's HTTP daemon and defeats authentication outright, an attacker reaching the web interface over the network gains access without credentials. Consumer and small-office routers frequently expose management interfaces, and public exploit availability lowers the barrier to mass opportunistic scanning.

What's Vulnerable

No other versions or products are listed in the supplied data.

Patch Status

The supplied source material does not identify a vendor patch, fixed firmware version, or advisory from Tenda. There is no CISA KEV entry for this CVE in the provided data, so there is no confirmed evidence of active exploitation and no federally mandated remediation deadline; though public proof-of-concept code is already available. Operators should restrict remote access to the AC10 web management interface pending vendor guidance.

Sources