{"id":"CVE-2026-19924","state":"PUBLISHED","title":"Tenda AC10 httpd R7WebsSecurityHandler improper authentication","description":"A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.","publishedAt":"2026-08-16T01:00:13.158Z","updatedAt":"2026-08-19T15:50:08.231Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Tenda AC10"],"affected":[{"vendor":"Tenda","product":"AC10","versions":[{"version":"16.03.10.09_multi_TDE01","status":"affected"}],"cpes":["cpe:2.3:o:tenda:ac10_firmware:*:*:*:*:*:*:*:*"],"modules":["httpd"]}],"references":["https://vuldb.com/vuln/390174","https://vuldb.com/vuln/390174/cti","https://vuldb.com/cve/CVE-2026-19924","https://vuldb.com/submit/871957","https://github.com/teiwiet/tenda-ac10-vulnerabilities/blob/main/authen-bypass-tenda-ac10.md","https://www.tenda.com.cn/"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19924.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19924","state":"PUBLISHED","datePublished":"2026-08-16T01:00:13.158Z","dateUpdated":"2026-08-19T15:50:08.231Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-08-15T05:24:58.354Z"},"containers":{"cna":{"title":"Tenda AC10 httpd R7WebsSecurityHandler improper authentication","descriptions":[{"lang":"en","value":"A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used."}],"affected":[{"vendor":"Tenda","product":"AC10","versions":[{"version":"16.03.10.09_multi_TDE01","status":"affected"}],"cpes":["cpe:2.3:o:tenda:ac10_firmware:*:*:*:*:*:*:*:*"],"modules":["httpd"]}],"references":[{"url":"https://vuldb.com/vuln/390174","name":"VDB-390174 | Tenda AC10 httpd R7WebsSecurityHandler improper authentication","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/390174/cti","name":"VDB-390174 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-19924","name":"CVE-2026-19924 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/871957","name":"Submit #871957 | Tenda AC10 V4.0 V16.03.10.09_multi_TDE01 Improper Authentication","tags":["third-party-advisory"]},{"url":"https://github.com/teiwiet/tenda-ac10-vulnerabilities/blob/main/authen-bypass-tenda-ac10.md","tags":["exploit"]},{"url":"https://www.tenda.com.cn/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","baseSeverity":"CRITICAL"}},{"cvssV3_1":{"version":"3.1","baseScore":9.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"CRITICAL"}},{"cvssV3_0":{"version":"3.0","baseScore":9.8,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"CRITICAL"}},{"cvssV2_0":{"version":"2.0","baseScore":10,"vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","type":"CWE","lang":"en","description":"Improper Authentication"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-08-16T01:00:13.158Z"},"timeline":[{"time":"2026-08-15T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-08-15T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-08-15T07:30:03.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"teiwiet (VulDB User)","type":"reporter"}],"x_generator":["VulDB PVTS v202608"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-19T15:49:55.747146Z","id":"CVE-2026-19924","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-19T15:50:08.231Z"}}]}}}