CVE-2026-123966

EUVD-2026-119293
A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/Tmzop/Tenda-AC19-saveParentControlInfo/blob/main/report.md
https://vuldb.com/cve/CVE-2026-123966
https://vuldb.com/submit/1035173
https://vuldb.com/vuln/432038
https://vuldb.com/vuln/432038/cti
https://www.tenda.com.cn/