CVE-2026-19821
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A buffer overflow vulnerability was found in the Tenda AC12 router version 15.03.06.23_multi_TD01 in the formSetRebootTimer function in the file /goform/SetSysAutoRebbotCfg of the httpd web management interface. Manipulating the rebootTime argument can cause a buffer overflow. The attack can be initiated remotely, and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker can exploit this vulnerability to execute arbitrary code on the router, potentially leading to full device and network compromise, traffic interception, or further attacks.
Recommendation
Update the Tenda AC12 router firmware to the latest available version if the vendor has released a fix. If not, restrict access to the management interface from external networks and monitor network traffic.
Original NVD description (English source)
A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.