Tenda AC19 httpd formSetFirewallCfg stack-based buffer overflow via firewallEn parameter

CVE-2026-113744 is a pre-authentication stack-based buffer overflow in the Tenda AC19 consumer Wi-Fi router, firmware version 16.03.10.07. The flaw lives in the formSetFirewallCfg handler at /goform/SetFirewallCfg within the device's built-in httpd web management service. By sending a crafted firewallEn parameter, an attacker can overwrite the stack and achieve remote code execution on the MIPS-based device — no credentials, no user interaction required. The affected firmware ships on a single hardware revision (AC19 V1.0) of a budget consumer router sold primarily through Amazon and Chinese e-commerce channels. The latest firmware Tenda has published for this model is V16.03.10.11 (January 2023), which *predates* this disclosure — and Tenda has not acknowledged this CVE or released a fix. There is no evidence the newer firmware is immune; the vendor's track record suggests the function may still be vulnerable.

The vendor-assigned CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — a perfect 10.0 — is technically accurate *for the device itself* but wildly misleading for any enterprise patching queue. The Scope: Changed modifier (S:C) assumes a compromised router pivots into other systems, which is fair in theory, but the entire premise collapses under a single question: *do you have any Tenda AC19 routers in your managed fleet?* The answer for any organization running 10,000 enterprise hosts is almost certainly no. This is a sub-$60 SOHO router with no enterprise management features, no SNMP fleet tooling, no central firmware orchestration, and no presence in any enterprise procurement catalog. The CVSS 10.0 score is a textbook example of how context-free scoring creates noise — this CVE will rank alongside Exchange RCEs and vCenter escapes in automated feeds, competing for the same patch-cycle attention it does not deserve.

Sources.

1. VulDB Entry #422925 — CVE-2026-113744
2. Strix.ai CVE-2026-113744 Analysis
3. Offseq Radar — Stack-based Buffer Overflow in Tenda AC19
4. henrythekingofuk/TendaCVE PoC Repository (referenced)
5. Tenda AC19 V1.0 Firmware Download (V16.03.10.11)
6. Tenda Security Vulnerability Statement for Discontinued Products
7. Vulners — TendaCVE Exploit Entry

Run this script from any Linux/macOS workstation on the same network segment as the suspected Tenda AC19. Invoke with: bash check_tenda_ac19.sh 192.168.0.1 — no special privileges required (uses curl). The script checks for the vulnerable /goform/SetFirewallCfg endpoint and attempts to fingerprint the firmware version.

#!/usr/bin/env bash
# check_tenda_ac19.sh — CVE-2026-113744 presence check
# Usage: bash check_tenda_ac19.sh <TARGET_IP>
# Exit codes: 0 = VULNERABLE, 1 = PATCHED/NOT_AFFECTED, 2 = UNKNOWN

set -euo pipefail

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <TARGET_IP>"
  exit 2
fi

URL="http://${TARGET}/goform/SetFirewallCfg"

# Step 1: Check if the device responds like a Tenda httpd
echo "[*] Probing $TARGET for Tenda httpd..."
HEADERS=$(curl -sI --connect-timeout 5 --max-time 10 "http://${TARGET}/" 2>/dev/null || true)

if echo "$HEADERS" | grep -qi 'tenda\|GoAhead'; then
  echo "[+] Tenda/GoAhead httpd detected."
else
  echo "[-] Target does not appear to be a Tenda device."
  echo "RESULT: NOT_AFFECTED"
  exit 1
fi

# Step 2: Check if /goform/SetFirewallCfg endpoint exists
echo "[*] Checking for vulnerable endpoint $URL ..."
HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 5 --max-time 10 -X POST "$URL" -d 'firewallEn=0' 2>/dev/null || echo "000")

if [[ "$HTTP_CODE" == "000" ]]; then
  echo "[-] Could not connect to $URL"
  echo "RESULT: UNKNOWN"
  exit 2
elif [[ "$HTTP_CODE" == "404" ]]; then
  echo "[-] Endpoint not found (HTTP 404). Device may not be AC19 or endpoint is removed."
  echo "RESULT: PATCHED"
  exit 1
elif [[ "$HTTP_CODE" == "200" || "$HTTP_CODE" == "302" ]]; then
  echo "[!] Endpoint /goform/SetFirewallCfg is LIVE (HTTP $HTTP_CODE)."
  echo "[!] Device is a Tenda with an accessible SetFirewallCfg handler."
  echo "[!] If firmware is V16.03.10.07, this device is vulnerable to CVE-2026-113744."
  echo ""
  echo "RESULT: VULNERABLE"
  exit 0
else
  echo "[?] Unexpected HTTP response: $HTTP_CODE"
  echo "RESULT: UNKNOWN"
  exit 2
fi