CVE-2026-19788

🗓️ 14 Aug 2026 03:00:10Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 32 Views🌐 WEB

Stack-based buffer overflow in Tenda AC1206 httpd web interface SetOnlineDevName via devName argument enables remote exploit.

Reporter	Title	Published	Views	Family All 7
attackerkb	CVE-2026-19788	14 Aug 202603:00	–	attackerkb
Circl	CVE-2026-19788	14 Aug 202605:10	–	circl
Cvelist	CVE-2026-19788 Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name stack-based overflow	14 Aug 202603:00	–	cvelist
EUVD	EUVD-2026-58573	14 Aug 202603:00	–	euvd
NVD	CVE-2026-19788	14 Aug 202604:16	–	nvd
Positive Technologies	PT-2026-71955	14 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-19788: Stack-based Buffer Overflow	14 Aug 202600:00	–	rapid7

Vulners

Node

tenda ac1206Match15.03.06.23_multi_td01

[
  {
    "vendor": "Tenda",
    "product": "AC1206",
    "versions": [
      {
        "version": "15.03.06.23_multi_TD01",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:o:tenda:ac1206_firmware:*:*:*:*:*:*:*:*"
    ],
    "modules": [
      "httpd web management interface"
    ]
  }
]

Source	Link
github	www.github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/1.md
vuldb	www.vuldb.com/vuln/389755/cti
vuldb	www.vuldb.com/cve/CVE-2026-19788
tenda	www.tenda.com.cn/
vuldb	www.vuldb.com/submit/868913
vuldb	www.vuldb.com/vuln/389755

Parameter	Position	Path	Description	CWE
devName	request body	/goform/SetOnlineDevName	Stack-based buffer overflow in the devName parameter of /goform/SetOnlineDevName; may be triggered remotely via the web management interface; public exploit available.	CWE-119, CWE-121

18 Aug 2026 02:17Current

8.3High risk

Vulners AI Score8.3

CVSS 48.7

CVSS 3.18.8

CVSS 38.8

CVSS 29

EPSS0.00854