# CVE-2026-113744: Tenda AC19 stack buffer overflow in firewall configuration

Source: https://junglewise.ai/threats/cve-2026-113744-a-security-vulnerability-has-been-detected-in-tenda-ac19-16-03  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-113744 · Severity: critical · CVSS 10 · Published 2026-10-21

Tenda AC19 is a wireless router that manages network traffic and security policies through a web interface. A stack buffer overflow vulnerability in the firewall configuration function allows remote attackers to execute arbitrary code and take complete control of the router, potentially compromising all connected devices and network traffic.

Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-113744 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113744 being exploited in the wild.

**How severe is CVE-2026-113744?** Critical severity, with a CVSS score of 10, published 21 October 2026.

**Which products and versions are affected?** Tenda AC19 16.03.10.07.

**Is there a fix for CVE-2026-113744?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-113744 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-113744?** Check whether you run Tenda AC19 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The httpd Web Management Service in Tenda AC19 16.03.10.07 contains a stack-based buffer overflow in the formSetFirewallCfg function (/goform/SetFirewallCfg) when processing the firewallEn parameter. The vulnerability is remotely exploitable without authentication and permits remote code execution with full device compromise.

## Affected products

- Tenda AC19 16.03.10.07

## Timeline

- 2026-10-21: disclosed: Vulnerability publicly disclosed

## References

- [https://github.com/henrythekingofuk/TendaCVE](https://github.com/henrythekingofuk/TendaCVE)
- [https://vuldb.com/cve/CVE-2026-113744](https://vuldb.com/cve/CVE-2026-113744)

## Related threats

- [Tenda AC19 heap buffer overflow in saveParentControlInfo](https://junglewise.ai/threats/cve-2026-123966-a-vulnerability-was-determined-in-tenda-ac19-16-03-10-07)