LiveActive security incident?Get immediate response
CVE Record

CVE-2026-19924: Tenda AC10 httpd R7WebsSecurityHandler improper authentication

A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A remotely reachable authentication flaw affects the Tenda AC10 router running firmware 16.03.10.09_multi_TDE01. Public exploit information exists, increasing practical risk. A successful attack could potentially compromise the router’s confidentiality, integrity, and availability, although the supplied sources do not confirm attacks in the wild.

Executive priority

Treat confirmed affected and externally reachable devices as an immediate remediation priority. Public exploit information and maximum supplied severity create substantial risk, despite no confirmed active exploitation. Require rapid inventory, exposure reduction, vendor-guidance review, and replacement planning if no supported correction exists.

Technical view

CVE-2026-19924 is CWE-287 improper authentication in the AC10 httpd component’s R7WebsSecurityHandler. The supplied CVSS v2.0 score is 10.0, indicating unauthenticated, low-complexity network access with complete impact. The precise bypass mechanism is publicly documented, but affected-version scope beyond the named firmware is not established here.

Likely exposure

Highest exposure exists where an affected router’s HTTP management service is reachable from untrusted networks or the internet. Internal access also matters if hostile or compromised devices can reach management services. Only firmware 16.03.10.09_multi_TDE01 is explicitly identified; exposure of other releases is unknown.

Exploitation context

A public exploit description is referenced, supporting proof-of-concept availability and elevated exploitation risk. However, the CVE is not identified as being in KEV, and the supplied evidence does not establish active exploitation in the wild. No payloads or operational exploitation details are included here.

Researcher notes

The evidence identifies R7WebsSecurityHandler but does not establish the vulnerable code path, default exposure, confirmed attack telemetry, or a vendor patch. The affected record names one firmware build while its CPE contains a wildcard firmware version; do not infer that every AC10 release is vulnerable without additional evidence.

Mitigation direction

  • Inventory Tenda AC10 devices and identify those running firmware 16.03.10.09_multi_TDE01.
  • Check current Tenda guidance for a corrected firmware release or vendor-approved mitigation.
  • Temporarily prevent internet and untrusted-network access to affected management interfaces.
  • Restrict administration to trusted devices and dedicated management networks where operationally possible.
  • Consider replacing affected devices if no supported correction or adequate isolation is available.

Validation and detection

  • Confirm each device model and installed firmware through trusted administrative records or local inspection.
  • Determine whether HTTP management is reachable from internet, guest, wireless, or other untrusted networks.
  • Review router and perimeter logs for unexpected management access or configuration changes.
  • Verify any vendor firmware guidance specifically covers this model and named firmware build.
  • After remediation, confirm management access is restricted and intended router configuration remains intact.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-287: Credential and account abuse lookup

Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-19924 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (2.0)
Known Exploited
No
Published

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

4CVSS vectors
6Timeline events
1ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: total

CVSS vector scores

4 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 2.0CriticalAV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR1010VulDB
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R3.95.9VulDB
9.8CVSS 3.0CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R3.95.9VulDB
9.3CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P——VulDB

Vulnerability scoring details

Base CVSS 4.0 score

9.3Critical
CVSS 4.0 vector shape for CVE-2026-19924Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineVulDB

    Advisory disclosed

  2. Source timelineVulDB

    VulDB entry created

  3. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  4. Source timelineVulDB

    VulDB entry last update

  5. CVE publishedCVE Program

    The CVE record was published.

  6. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
TendaAC1016.03.10.09_multi_TDE01Listed
Weakness

CWE details

CWE-287

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-287 · source CWE mapping

Improper Authentication

Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs