CVE-2026-19924

CVSS 9.8 (critical) · published 2026-08-16

A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Weakness: CWE-287

Source: NVD CVE-2026-19924

References

• https://github.com/teiwiet/tenda-ac10-vulnerabilities/blob/main/authen-bypass-tenda-ac10.md
• https://vuldb.com/cve/CVE-2026-19924
• https://vuldb.com/submit/871957
• https://vuldb.com/vuln/390174
• https://vuldb.com/vuln/390174/cti
• https://www.tenda.com.cn/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.