Tenda AC19 Firmware 16.03.10.07 Faces Critical Remote Overflow Risk

Tenda AC19 routers operating on firmware version 16.03.10.07 are exposed to a critical remote security flaw. The vulnerability exists within the httpd Web Management Service component. Specifically, the function formSetFirewallCfg in the file /goform/SetFirewallCfg is vulnerable. Manipulation of the firewallEn argument triggers a stack-based buffer overflow. Attackers can launch this exploit remotely. The source material does not specify authentication requirements for the attack.

How it unfolded

• Researchers identified a stack-based buffer overflow in the Tenda AC19 firmware version 16.03.10.07.
• The flaw was logged as CVE-2026-113744 with a CVSS score of 10.0, indicating critical severity.
• The exploit has been disclosed publicly and may be used.

Who is affected

Tenda AC19 devices running firmware version 16.03.10.07 are confirmed to be affected by this specific issue. The vulnerability resides in the firewall configuration handling of the web management interface. Because the attack vector is remote, any device with this firmware version accessible from an untrusted network is at risk. The source material lists only this specific version as affected.

Our take on the response

The source material does not mention the status of any vendor patch. With the exploit publicly disclosed, the window for safe exposure is closing rapidly. Organizations cannot rely on standard update cycles to mitigate this risk without confirmed fixes. Immediate containment measures are required to protect endpoints behind these routers. The high CVSS score underscores the potential for total system compromise if the flaw is exploited.

Who needs to act first

Teams should prioritize isolating any Tenda AC19 units running the vulnerable firmware from untrusted networks. Since no patch status is confirmed, physical or logical segregation is the only effective control. Check network diagrams to identify where these devices sit. If they face the internet, disconnect them immediately. For internal-only devices, verify that remote management ports are closed. Document all affected serial numbers for future remediation. Test connectivity after isolation to ensure business continuity is maintained through alternative paths.

Background: Attack vectors

Attack vectors are the paths adversaries use to reach your data. They range from simple phishing emails to complex supply chain compromises. Defending against them requires mapping every entry point, validating inputs, and limiting what each component can do. You cannot stop all attacks, but you can make them costly and slow.

Read the full guide: Attack Vectors Explained: Mechanisms, Limits, and Defense Strategies

What to do and how to stay safe: Tenda

• Isolate affected Tenda AC19 routers from external networks immediately to prevent remote exploitation.
• Monitor network traffic for unusual activity originating from or targeting the affected devices.
• Contact the vendor regularly to check for the release of a security update or firmware patch.
• Review firewall rules to block unauthorized access to the web management interface of these devices.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific firmware version is vulnerable?

Tenda AC19 routers running firmware version 16.03.10.07 are affected by this vulnerability.

Is there a patch available for CVE-2026-113744?

The source material does not mention the status of any vendor patch or fix.

What type of vulnerability is this?

It is a stack-based buffer overflow in the firewall configuration service of the web management interface.