CVE-2026-19821
Received Received - Intake

Buffer Overflow in Tenda AC12 Router Firmware

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19821
EUVD
EUVD-2026-58616

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tenda ac12 to 15.03.06.23 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a buffer overflow in the Tenda AC12 router's web management interface. It occurs in the formSetRebootTimer function when processing the rebootTime argument. The flaw allows attackers to send a specially crafted rebootTime value that exceeds the buffer size, leading to memory corruption. The issue stems from improper input validation and lack of bounds checking during string formatting.

Detection Guidance

To detect this vulnerability, check if your Tenda AC12 router is running firmware version US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin or similar. Examine the httpd web management interface for the formSetRebootTimer function in /goform/SetSysAutoRebbotCfg. Look for improper handling of the rebootTime parameter that could lead to buffer overflow.

Impact Analysis

This vulnerability may allow remote attackers to execute arbitrary code on the affected router or cause a denial-of-service condition. Successful exploitation could lead to unauthorized access, device takeover, or disruption of network services. The attack can be initiated remotely without authentication.

Compliance Impact

This vulnerability, a buffer overflow in Tenda AC12's web interface, could lead to unauthorized remote access or denial-of-service. Such breaches may violate GDPR's security requirements for protecting personal data and HIPAA's safeguards for sensitive health information if exploited on systems handling regulated data.

Mitigation Strategies

Immediately update the Tenda AC12 router firmware to the latest patched version. Disable remote access to the httpd web management interface if not required. Monitor network traffic for unusual activity targeting the SetSysAutoRebbotCfg endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19821. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart