CVE-2026-19789
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. The function set_wl_guest_iplist in /goform/WifiGuestSet of the httpd web management interface is affected. Manipulating the argument shareSpeed causes stack-based buffer overflow. Remote exploitation is possible, and the exploit has been publicly disclosed.
Risk Assessment
Stack-based buffer overflow could allow remote code execution or device crash, potentially compromising Wi-Fi network security.
Recommendation
Update Tenda AC1206 firmware to the latest patched version. Restrict management interface access and change default passwords.
Other vulnerabilities in Tenda AC1206
See all- CVE-2026-82694Critical
A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.
- CVE-2026-82693Critical
A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web UI. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-19788High
A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. The function set_device_name in /goform/SetOnlineDevName of the httpd web management interface is affected. Manipulating the argument devName results in stack-based buffer overflow. The attack may be launched remotely, and the exploit has been made public.
- CVE-2026-36789High
In the Tenda AC1206 router with firmware version v15.03.06.23, multiple stack overflows exist in the fromGstDhcpSetSer function via the username and password parameters. These vulnerabilities allow an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.
Original NVD description (English source)
A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGuestSet of the component httpd web management interface. This manipulation of the argument shareSpeed causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS