# CVE-2026-123966: Tenda AC19 heap buffer overflow in saveParentControlInfo

Source: https://junglewise.ai/threats/cve-2026-123966-a-vulnerability-was-determined-in-tenda-ac19-16-03-10-07  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-123966 · Severity: critical · CVSS 10 · Published 2026-11-07

The Tenda AC19 Wi-Fi router's web management interface contains a heap buffer overflow vulnerability in the saveParentControlInfo function that can be exploited remotely without authentication. An attacker can send a specially crafted request to crash the router's web service, force a reboot, or potentially execute arbitrary code with root privileges. This affects any AC19 device exposed to network access, putting both the device and connected networks at risk.

Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-123966 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123966 being exploited in the wild.

**How severe is CVE-2026-123966?** Critical severity, with a CVSS score of 10, published 7 November 2026.

**Which products and versions are affected?** Tenda AC19 16.03.10.07.

**Is there a fix for CVE-2026-123966?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-123966 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-123966?** Check whether you run Tenda AC19 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a heap-based buffer overflow (CWE-122) in the /goform/saveParentControlInfo endpoint, where user-controlled parameters (deviceId, time, and urls) are copied into fixed-size buffers using unsafe functions like strcpy() without length validation. The deviceId parameter is written to a 596-byte heap buffer via strcpy(ptr + 2, src), and the time parameter is parsed into 4-byte stack buffers via unbounded sscanf() conversions. No authentication is required, making this remotely exploitable by any attacker with network access to the device.

## Affected products

- Tenda AC19 16.03.10.07

## Timeline

- 2026-11-07: disclosed

## References

- [https://github.com/Tmzop/Tenda-AC19-saveParentControlInfo/blob/main/report.md](https://github.com/Tmzop/Tenda-AC19-saveParentControlInfo/blob/main/report.md)
- [https://vuldb.com/cve/CVE-2026-123966](https://vuldb.com/cve/CVE-2026-123966)

## Related threats

- [Tenda AC19 stack buffer overflow in firewall configuration](https://junglewise.ai/threats/cve-2026-113744-a-security-vulnerability-has-been-detected-in-tenda-ac19-16-03)