CVE-2026-113744 Overview
CVE-2026-113744 is a stack-based buffer overflow in the Tenda AC19 wireless router running firmware version 16.03.10.07. The flaw resides in the formSetFirewallCfg function handling requests to /goform/SetFirewallCfg within the httpd Web Management Service. Attackers manipulate the firewallEn argument to corrupt the stack. Exploitation requires no authentication and can be performed remotely across the network. The exploit has been disclosed publicly, increasing the risk of opportunistic attacks against exposed devices.
Critical Impact
Unauthenticated remote attackers can trigger a stack-based buffer overflow in the router's management service, potentially leading to arbitrary code execution and full device compromise.
Affected Products
- Tenda AC19 wireless router
- Firmware version 16.03.10.07
- httpd Web Management Service component
Discovery Timeline
- 2026-10-21 - CVE-2026-113744 published to the National Vulnerability Database (NVD)
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-113744
Vulnerability Analysis
The vulnerability is a classic stack-based buffer overflow classified as [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). The formSetFirewallCfg handler processes HTTP POST requests sent to /goform/SetFirewallCfg on the device's embedded web management interface. The handler reads the firewallEn parameter from the request and copies it into a fixed-size stack buffer without validating its length.
Because the Tenda httpd service runs with root privileges on the device, successful memory corruption directly undermines the integrity of the router. The attacker reaches the vulnerable code path over the network without providing credentials or user interaction. A public proof-of-concept is referenced in the GitHub PoC Repository, lowering the barrier to exploitation.
Root Cause
The root cause is missing bounds checking on attacker-controlled input before it is written into a stack-allocated buffer inside formSetFirewallCfg. The firewallEn argument, received from an HTTP request, is copied without a length constraint. Oversized input overwrites adjacent stack memory, including the saved return address and local variables.
Attack Vector
The attack vector is purely network-based against the router's HTTP management interface. An attacker crafts a POST request to /goform/SetFirewallCfg with an oversized firewallEn value. When the router processes the request, the overflow corrupts the call stack. Depending on the device's memory layout and protections, this can lead to denial of service or arbitrary code execution. See the VulDB CVE Entry for additional technical context.
No verified exploit code is reproduced here. Refer to the public references for proof-of-concept details.
Detection Methods for CVE-2026-113744
Indicators of Compromise
- HTTP POST requests to /goform/SetFirewallCfg containing abnormally long firewallEn parameter values.
- Unexpected httpd process crashes or reboots on Tenda AC19 devices.
- Outbound connections from the router to unknown hosts following suspicious management-plane requests.
- Configuration changes to firewall settings that were not initiated by an administrator.
Detection Strategies
- Inspect network traffic to the router's management interface for requests to /goform/SetFirewallCfg with oversized or non-printable payloads in firewallEn.
- Deploy intrusion detection system (IDS) signatures that flag malformed Tenda goform requests from untrusted sources.
- Correlate device reboot events with recent inbound HTTP traffic to the management service.
Monitoring Recommendations
- Centralize router syslog output and alert on repeated httpd restarts or crashes.
- Monitor for exposure of the router administrative interface to WAN-facing interfaces or untrusted VLANs.
- Track lateral movement attempts originating from network segments where the router is reachable.
How to Mitigate CVE-2026-113744
Immediate Actions Required
- Restrict access to the router's web management interface to trusted internal management hosts only.
- Disable remote (WAN-side) management on the Tenda AC19 if it is enabled.
- Place vulnerable devices behind a firewall that blocks inbound HTTP to the management interface.
- Audit router configurations for unauthorized firewall rule changes.
Patch Information
At the time of publication, no vendor patch for CVE-2026-113744 is referenced in the available advisories. Review the Tenda Official Website for firmware updates addressing the formSetFirewallCfg buffer overflow and apply them as soon as they become available.
Workarounds
- Segment the router's management interface onto a dedicated administrative VLAN.
- Replace the affected Tenda AC19 device with a supported model if no firmware fix is released.
- Enforce network access control lists (ACLs) that restrict HTTP access to /goform/SetFirewallCfg to authorized administrator workstations.
- Monitor the VulDB Vulnerability Listing for updated remediation guidance.
# Example ACL concept: block external access to the router management port
# Replace <router_ip> and <mgmt_admin_subnet> with real values
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <mgmt_admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
