A critical vulnerability in the Tenda AC19 router has been given the maximum possible severity score, and public exploit code is already available, putting owners of the popular home router at risk.

The flaw, tracked as CVE-2026-123966, is a heap-based buffer overflow in the router's parental-control function, saveParentControlInfo, in firmware version 16.03.10.07. An attacker can trigger it remotely by manipulating the deviceId argument sent to the router's web endpoint, potentially taking complete control of the device.

The vulnerability was published on 7 November 2026 and carries a CVSS score of 10.0, the highest rating on the scale. Both vulnerability trackers reporting it note that exploit code has been publicly disclosed, which means attackers do not need to develop their own method to target the flaw.

No fixed firmware version is listed in the CVE record, so owners cannot yet patch the problem by updating. That leaves the usual defences as the only protection: keeping the router's administration interface away from the internet, changing default passwords, and checking the vendor's website for a security update.

Routers are a favoured target for attackers because they sit at the edge of a home or small-business network and are rarely updated. A compromised router can be used to spy on traffic, redirect users to fake websites, or recruit the device into a botnet used for further attacks.

Anyone running a Tenda AC19 on firmware 16.03.10.07 should check whether their device is exposed to the internet and watch for a patched firmware release from Tenda.

[Source: radar.offseq.com](https://radar.offseq.com/threat/a-vulnerability-was-determined-in-tenda-ac19-16031007-cve-2026-123966-fde5daff883c4ec6) | [Source: portal.vyprsec.ai](https://portal.vyprsec.ai/cves/CVE-2026-123966)