Tenda AC19 CVE-2026-123966: confirmed affected firmware and evidence summary

CVE-2026-123966 affects Tenda AC19 firmware 16.03.10.07. Version 16.03.10.11 is higher-numbered, but its captured vendor notes do not confirm it as the fix.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

Black four-antenna router beneath a cyan shield with an amber warning symbol and flowing network lines.
AI-generated editorial illustration of a router security warning; not an official product image or documentary evidence.

Security advisory candidate

Tenda AC19 firmware 16.03.10.07 is confirmed affected by CVE-2026-123966.12

Tenda publishes firmware version 16.03.10.11, which is higher-numbered than confirmed-affected 16.03.10.07, but the captured 16.03.10.11 release notes do not name this CVE or say the vulnerability is fixed.13

Reporting cutoff: November 8, 2026, 12:04:56 UTC.

What is confirmed

VulDB is the CNA for this CVE record; its record describes a remotely reachable heap-based buffer overflow in the AC19 saveParentControlInfo function, caused by manipulation of the deviceId argument.1

VulDB’s CNA record assigns CVSS v3.1 10.0 Critical with network attack vector, low complexity, no privileges and no user interaction in its vector.1

VulDB’s CNA record says an exploit has been publicly disclosed and may be used; that is a disclosure statement, not evidence that attackers are exploiting the flaw in the wild.1

The public researcher report says testing on 16.03.10.07 caused the management service to crash and the device to reboot, while arbitrary code execution was described only as potential.4

As of the reporting cutoff, CVE-2026-123966 was not listed in CISA KEV catalog version 2026.11.06, released 2026-11-06T19:44:45.1797Z.5

Who should act

Treat a device as in scope only when it is a Tenda AC19 v1.0 running firmware 16.03.10.07 and untrusted traffic can reach its web management interface.124

The captured Tenda 16.03.10.11 release notes do not name CVE-2026-123966 or identify that build as a fix.3

Practical guidance

  1. Confirm the exact model, hardware revision and installed firmware before classifying a device; do not classify it by product family alone.12
  2. If the device matches 16.03.10.07, keep its administration interface unavailable from the public internet and limit management to a trusted local path or an already-approved secure administrative path.1
  3. Treat unexplained management-service crashes or router reboots as triage signals, not proof that CVE-2026-123966 was exploited.4
  4. Do not present 16.03.10.11 as the CVE fix. If an authorized owner considers any firmware change, confirm AC19 v1.0 compatibility, follow the vendor’s model-specific upgrade notes and plan for the vendor-directed factory reset.3

Verify the outcome

  • Recheck the active model, hardware revision and firmware after any authorized change.3
  • Watch for repeated management-service failures or unexpected reboots after containment or an authorized change, while keeping those symptoms classified as non-unique signals.4

What remains unknown

  • Whether firmware 16.03.10.11 is vulnerable, fixed or unaffected is not established by the captured vendor release notes.3
  • The CVE record, researcher report and bounded CISA KEV observation do not establish successful exploitation in the wild.145
  • The CVE record and captured Tenda 16.03.10.07 page do not establish the number of exposed devices or the default WAN-management state.12

Sources

  1. CVE Program record for CVE-2026-123966 (retrieved 2026-11-08T12:04:56Z)
  2. Tenda AC19 v1.0 firmware 16.03.10.07 page (retrieved 2026-11-08T12:04:56Z)
  3. Tenda AC19 v1.0 firmware 16.03.10.11 page and release notes (retrieved 2026-11-08T12:04:56Z)
  4. Researcher disclosure for saveParentControlInfo (retrieved 2026-11-08T12:04:56Z)
  5. CISA Known Exploited Vulnerabilities catalog (catalog-scoped zero-match observation at 2026-11-08T12:04:56Z)

Browse Articles

Latest Articles