CVE-2026-19788
Received Received - Intake

Stack-Based Buffer Overflow in Tenda AC1206 Router

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the component httpd web management interface. The manipulation of the argument devName results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19788
EUVD
EUVD-2026-58573

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tenda ac1206 15.03.06.23_multi_td01
tenda ac12 us_ac1206v1.0rtl_v15.03.06.23_multi_td01

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19788 is a stack-based buffer overflow vulnerability in the Tenda AC1206 router's web management interface. It occurs in the set_device_name function when processing the devName parameter from the SetOnlineDevName form. The function uses sprintf to write user-controlled input into a fixed-size buffer without proper length validation, allowing an attacker to overflow the stack by providing an excessively long devName value.

Detection Guidance

To detect this vulnerability, check if your Tenda AC1206 router is running firmware version US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin or similar. Inspect the httpd web management interface for the SetOnlineDevName form handling. Look for buffer overflow indicators in the formSetDeviceName function or set_device_name component.

Impact Analysis

This vulnerability can be exploited remotely to execute arbitrary code or cause a denial of service on the affected Tenda AC1206 router. An attacker could gain control of the device, steal sensitive information, or disrupt network operations. Since the exploit is public, the risk of real-world attacks is elevated.

Compliance Impact

This vulnerability, a stack-based buffer overflow in Tenda AC1206's HTTP daemon, could lead to unauthorized code execution or denial of service. Such flaws may violate compliance requirements under GDPR (data protection) or HIPAA (health data security) by enabling data breaches or system disruptions if exploited.

Mitigation Strategies

Immediately update the router firmware to the latest patched version. Disable remote access to the httpd web management interface if not required. Block external access to the SetOnlineDevName form endpoint. Monitor network traffic for unusual activity targeting the httpd service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19788. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart