CVE-2026-123966

Summary

A heap-based buffer overflow in Tenda AC19 firmware v16.03.10.07 occurs when the saveParentControlInfo endpoint processes a malformed deviceId parameter, allowing remote code execution without authentication due to insufficient input validation.

Exploitability

Exploitation is trivial for remote attackers as it requires only sending a crafted HTTP request to the public endpoint with no authentication or user interaction.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, availability) of the router, enabling pivot attacks into the internal network, traffic interception, or persistent backdoor installation.

Detection

Look for repeated HTTP POST requests to /goform/saveParentControlInfo with abnormally long deviceId values (>256 bytes) in web server logs or IDS alerts; also monitor for unexpected heap corruption events or service crashes on the device following such requests.

Prioritized remediation

Upgrade to firmware version 16.03.10.08 or later, as Tenda has released a patched version addressing this vulnerability in that specific release.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.