CVE-2026-19821CWE-119CWE-120

CVE-2026-19821

High · published August 14, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
57.9
In the wild
Unconfirmed
What it is

A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00854 · 57.9th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2026-08-14T15:16Z
References (6)
https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/4.md · [email protected]https://vuldb.com/cve/CVE-2026-19821 · [email protected]https://vuldb.com/submit/868922 · [email protected]https://vuldb.com/vuln/389954 · [email protected]https://vuldb.com/vuln/389954/cti · [email protected]https://www.tenda.com.cn/ · [email protected]
EPSS history
Timeline
  • 14 AUG 11:00Z
    Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflow
    cvelistv5