AI analysis
Claude Opus · 9 Nov 2026, 10:19 CET
Tenda AC19 router flaw allows remote heap buffer overflow via parental controls
A heap-based buffer overflow in the Tenda AC19 (16.03.10.07) saveParentControlInfo handler can be triggered remotely without authentication via the deviceId parameter. The exploit is public. No fixed version is listed.
In plain terms
The Tenda AC19 is a home or small-office Wi-Fi router. A flaw in the part of its web interface that saves parental control settings can be abused by sending specially crafted data to a specific device identifier field. This can corrupt the router's memory, a condition known as a buffer overflow, where more data is written than the allocated space can hold.
Because the attack can be carried out remotely and needs no login, anyone able to reach the router's management interface could potentially crash it or take control of it. Owners of this router model and anyone responsible for networks using it should treat this as serious, especially if the management interface is reachable from untrusted networks.