CVE-2026-19924CWE-287

CVE-2026-19924

Critical · published August 16, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
72.5
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.01415 · 72.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-08-16T06:16Z
References (6)
https://github.com/teiwiet/tenda-ac10-vulnerabilities/blob/main/authen-bypass-tenda-ac10.md · [email protected]https://vuldb.com/cve/CVE-2026-19924 · [email protected]https://vuldb.com/submit/871957 · [email protected]https://vuldb.com/vuln/390174 · [email protected]https://vuldb.com/vuln/390174/cti · [email protected]https://www.tenda.com.cn/ · [email protected]
EPSS history
Timeline
  • 16 AUG 01:00Z
    Tenda AC10 httpd R7WebsSecurityHandler improper authentication
    cvelistv5