Security readout for executives and security teams
Plain-English summary
A flaw in the Tenda AC1206 management interface can overflow memory when it processes a crafted guest Wi-Fi speed value. Successful exploitation could compromise confidentiality, integrity, and availability. Risk is concentrated in devices running firmware 15.03.06.23_multi_TD01, particularly where management access is reachable by untrusted users.
Executive priority
Prioritize identification and containment immediately because the reported impact is critical and proof-of-concept material is public. Remediation urgency is highest for exposed management interfaces. No vendor patch is identified in the supplied sources, so confirm current Tenda guidance and plan isolation or replacement where necessary.
Technical view
CVE-2026-19789 is a stack-based buffer overflow in set_wl_guest_iplist within the /goform/WifiGuestSet handler. Manipulating the shareSpeed argument can corrupt stack memory. The supplied CVSS v2 vector indicates network access, low complexity, and required authentication. The sources report remote exploitation and a public proof of concept, but do not establish successful attacks in the wild.
Likely exposure
Confirmed scope is limited to Tenda AC1206 firmware 15.03.06.23_multi_TD01. Exposure depends on whether the httpd management interface is enabled and reachable. Internet-accessible administration presents the greatest concern, while restricted management networks reduce opportunity. The supplied evidence does not identify other affected versions or products.
Exploitation context
A public disclosure and proof of concept exist, increasing the likelihood of attempted exploitation. The supplied CVSS vector indicates authentication is required. This CVE is not listed as KEV in the bundle, and no cited evidence confirms active exploitation. Treat public exploit availability as elevated risk, not proof of compromise.
Researcher notes
The evidence identifies CWE-119 and CWE-121 and specifically associates shareSpeed processing with stack corruption. Product naming differs across references, including AC1206 and an AC12 submission label; do not broaden scope without vendor or CVE confirmation. Root-cause depth, exploit reliability, privilege outcome, patch status, and telemetry for detecting exploitation remain insufficiently documented.
Mitigation direction
- Restrict the management interface to trusted administrative networks and authorized users.
- Disable internet-facing or otherwise unnecessary remote management access.
- Check Tenda guidance for patched firmware or vendor-approved remediation.
- Replace or isolate affected devices if no supported fix is available.
- Monitor management-interface access for unexpected requests and authentication activity.
Validation and detection
- Inventory Tenda AC1206 devices and record their installed firmware versions.
- Confirm whether any device runs 15.03.06.23_multi_TD01.
- Review firewall and routing controls governing management-interface reachability.
- Verify management access requires strong, unique credentials.
- Review relevant logs for unusual WifiGuestSet requests or unexplained device instability.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-19789 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR810VulDBCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R2.85.9VulDBCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R2.85.9VulDBCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P——VulDBVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 3.0 score
8.8HighVector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 2.0 score
9CriticalVector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineVulDB
Advisory disclosed
- Source timelineVulDB
VulDB entry created
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineVulDB
VulDB entry last update
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- VDB-389756 | Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflowCVE reference, VulDB · vdb-entry, technical-description
- VDB-389756 | CTI Indicators (IOB, IOC, IOA)CVE reference, VulDB · signature, permissions-required
- CVE-2026-19789 | CVE Analysis and ReportCVE reference, VulDB · third-party-advisory
- Submit #868921 | Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin Buffer OverflowCVE reference, VulDB · third-party-advisory
- https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/2.mdCVE reference, VulDB · exploit
- https://www.tenda.com.cn/CVE reference, VulDB · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.