The vulnerability CVE-2026-19924 in Tenda AC10 firmware 16.03.10.09_multi_TDE01 involves improper authentication in the R7WebsSecurityHandler function within the httpd component. This allows an unauthenticated remote attacker to bypass authentication controls. The issue is classified under CWE-287 (Improper Authentication). The CVSS 3.1 base score is 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. Although public exploit information exists, no active exploitation has been reported. No patch or vendor advisory is currently available.

Successful exploitation allows remote attackers to bypass authentication mechanisms on the affected Tenda AC10 device, potentially leading to unauthorized access and control over the device. This can compromise device confidentiality, integrity, and availability. The vulnerability requires no privileges or user interaction to exploit and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device and monitor for updates from Tenda regarding patches or mitigations.