The vulnerability CVE-2026-19789 exists in the Tenda AC1206 router firmware version 15.03.06.23_multi_TD01. It is a stack-based buffer overflow triggered by manipulating the shareSpeed argument in the set_wl_guest_iplist function of the /goform/WifiGuestSet endpoint in the httpd web management interface. This flaw allows remote attackers to potentially execute arbitrary code or cause denial of service. The vulnerability is remotely exploitable without user interaction and has been publicly disclosed. No official patch or remediation level has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability could allow remote attackers to cause a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restricting access to the web management interface from untrusted networks may reduce exposure.