The Tenda AC1206 router firmware version 15.03.06.23_multi_TD01 contains a stack-based buffer overflow vulnerability in the set_wl_guest_iplist function of the /goform/WifiGuestSet HTTP management interface component. By sending a specially crafted request manipulating the shareSpeed parameter, an attacker can overflow the stack buffer remotely. This vulnerability allows for potential remote code execution or denial of service. The vulnerability is assigned CVE-2026-19789 with a CVSS 4.0 score of 8.7 (high severity). Although the exploit code has been publicly disclosed, there is no official patch or remediation level provided by the vendor as of the publication date.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected Tenda AC1206 device. This could allow an attacker to take control of the device or disrupt its normal operation. The vulnerability is remotely exploitable without user interaction and requires low attack complexity, increasing the risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting access to the device's web management interface from untrusted networks and monitor for any unusual activity. No official vendor remediation or temporary fix is currently available.