CVE-2026-19789 is a stack-based buffer overflow vulnerability in the Tenda AC1206 router firmware 15.03.06.23_multi_TD01. It affects the set_wl_guest_iplist function within the /goform/WifiGuestSet endpoint of the httpd web management interface. The vulnerability is triggered by manipulating the shareSpeed argument, leading to memory corruption. This can be exploited remotely by an attacker with low privileges and no user interaction is required. The vulnerability has a CVSS 3.1 score of 8.8 (high severity) indicating high impact on confidentiality, integrity, and availability. Public exploit code has been disclosed, but there are no reports of active exploitation in the wild. No patch or official remediation has been provided or linked.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service due to stack-based buffer overflow. The attacker requires low privileges and no user interaction, making it a significant risk. Confidentiality, integrity, and availability of the affected device can be fully compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor for vendor updates. In the meantime, restricting access to the web management interface and disabling remote management if possible can reduce exposure.