CVE-2026-19924
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
A vulnerability has been detected in the Tenda AC10 router version 16.03.10.09_multi_TDE01. It affects the R7WebsSecurityHandler function in the httpd component, leading to improper authentication. The attack can be initiated remotely, and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker can exploit improper authentication to gain unauthorized access to the router, potentially leading to full control over the device and network.
Recommendation
Update the router firmware to the latest version if available. Restrict access to the admin panel and change default passwords.
Other vulnerabilities in Tenda AC10
See all- CVE-2026-16248High
A vulnerability was found in Tenda AC10 version 16.03.10.09_multi_TDE01 in the fromAdvSetLanip function of the /goform/AdvSetLanip file. Manipulation of the GetValue/SetValue arguments leads to a stack-based buffer overflow, which can be exploited remotely.
- CVE-2026-51380Critical
A buffer overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or potentially execute remote code via the /cgi-bin/UploadCfg endpoint.
- CVE-2023-40904Critical
A stack overflow was discovered in Tenda AC10 v4 related to the parameters macFilterType and deviceList at the endpoint /goform/setMacFilterCfg.
- CVE-2023-37144Critical
A command injection vulnerability was discovered in Tenda AC10 v15.03.06.26 via the mac parameter in the function formWriteFacMac.
- CVE-2026-5550High
A stack-based buffer overflow vulnerability was identified in the fromSysToolChangePwd function of the /bin/httpd file in Tenda AC10 firmware version 16.03.10.10_multi_TDE01. The attack can be initiated remotely and may affect multiple endpoints.
- CVE-2026-5549Medium
Vulnerability in Tenda AC10 version 16.03.10.10_multi_TDE01, in the file /webroot_ro/pem/privkeySrv.pem of the RSA 2048-bit Private Key Handler component. Manipulation leads to use of a hard-coded cryptographic key. Remote attack possible, exploit publicly available.
- CVE-2026-5548High
A stack-based buffer overflow vulnerability has been found in Tenda AC10 16.03.10.10_multi_TDE01 in the function fromSysToolChangePwd of the file /bin/httpd. Manipulating the argument sys.userpass results in buffer overflow, and the attack can be initiated remotely.
- CVE-2026-5547Medium
In the Tenda AC10 router version 16.03.10.10_multi_TDE01, the function formAddMacfilterRule in file /bin/httpd is vulnerable to OS command injection. The attack can be performed remotely, and multiple endpoints may be affected.
- CVE-2025-57220Medium
An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 to escalate privileges to root via a crafted UDP packet.
- CVE-2025-57218Medium
Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the security_5g parameter in the function sub_46284C.
Original NVD description (English source)
A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS