CVE-2026-19788 is a stack-based buffer overflow vulnerability affecting the Tenda AC1206 router firmware version 15.03.06.23_multi_TD01. The issue occurs in the set_device_name function within the /goform/SetOnlineDevName endpoint of the HTTP web management interface. By sending a specially crafted devName argument, an attacker can cause a stack-based buffer overflow remotely. Public exploit code is available, increasing the risk of exploitation. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity. No official patch or remediation guidance has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability could allow a remote attacker to cause a stack-based buffer overflow on the affected device. This may lead to denial of service or potentially arbitrary code execution depending on the exploit. The vulnerability affects the device's web management interface, which is typically exposed on local networks or possibly the internet if misconfigured. The availability of public exploit code increases the likelihood of attacks, although no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the device's web management interface to trusted networks only and disable remote management if enabled. Monitor vendor channels for updates and apply patches promptly once available.