CVE-2026-113744: Tenda AC19 httpd Stack Overflow (CVSS 10) — Detection and Remediation Guide

---
title: HTTP Request to Tenda SetFirewallCfg Endpoint With Oversized firewallEn Parameter
id: 3f8a1c44-7b2d-4e91-a6c5-9d0e2f8b1a37
status: experimental
description: Detects HTTP requests targeting the Tenda AC19 /goform/SetFirewallCfg handler, the vulnerable endpoint in CVE-2026-113744. Any request to this endpoint from an untrusted or non-administrative source is suspicious; repeated or oversized requests indicate exploitation attempts of the firewallEn stack buffer overflow.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-113744
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/goform/SetFirewallCfg'
      - '/goform/setFirewallCfg'
  selection_param:
    cs-uri-query|contains:
      - 'firewallEn='
  condition: selection_uri or selection_param
falsepositives:
  - Legitimate administrator firewall configuration changes from known management hosts (filter by source IP allowlist)
level: high
---
title: Suspicious Child Process Spawned by Router httpd Binary
id: 8c2e5b91-3d4f-4a67-b8c2-1e5f9a0d6c48
status: experimental
description: Detects the embedded httpd web server spawning shell interpreters or download utilities. Successful exploitation of CVE-2026-113744 (Tenda AC19 stack overflow) typically results in httpd spawning sh, wget, curl, or tftp to fetch second-stage payloads. Applies where the router or similar embedded Linux devices forward process telemetry (e.g., via syslog or a management agent).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-113744
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/ash'
      - '/wget'
      - '/curl'
      - '/tftp'
      - '/nc'
      - '/ncat'
  condition: all of selection_*
falsepositives:
  - Legitimate router CGI scripts that invoke shell helpers (rare on Tenda; baseline known-good handlers before tuning)
level: critical
---
title: Outbound Download or Reverse Shell Attempt From Embedded Device Network Segment
id: 5a1d9c72-6e8b-4f23-a7d4-2c9e8b3f5a19
status: experimental
description: Detects egress connections from the network segment hosting consumer routers/IoT devices to uncommon external destinations or well-known payload-hosting ports. Compromised routers following exploitation of CVE-2026-113744 commonly beacon or fetch payloads over high ports, raw IP destinations, or known botnet infrastructure.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-113744
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: firewall
detection:
  selection_src:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  selection_device_zone:
    src_zone: 'iot'
  selection_dst:
    dst_ip|cidr:
      - '0.0.0.0/0'
  filter_rfc1918_dst:
    dst_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_device_zone and selection_dst and not filter_rfc1918_dst
falsepositives:
  - Firmware update checks and NTP from router devices (allowlist vendor update servers and NTP pools)
level: medium

let RouterSubnets = dynamic(["192.168.0.0/24", "10.0.0.0/24"]);
let VulnEndpoint = "/goform/SetFirewallCfg";
// Stage 1: requests to the vulnerable handler
union isfuzzy=true
    (CommonSecurityLog
    | where RequestURL contains VulnEndpoint or AdditionalExtensions has "firewallEn"
    | project TimeGenerated, SourceIP, DestinationIP, RequestMethod, RequestURL, Source = "CEF"),
    (Syslog
    | where SyslogMessage contains VulnEndpoint or SyslogMessage has "firewallEn"
    | project TimeGenerated, SourceIP = HostIP, DestinationIP = "", RequestMethod = "", RequestURL = SyslogMessage, Source = "Syslog")
| extend IsOversizedParam = strlen(tostring(RequestURL)) > 200
| summarize RequestCount = count(), OversizedCount = countif(IsOversizedParam), Sources = make_set(SourceIP) by DestinationIP, bin(TimeGenerated, 1h)
| where RequestCount > 3 or OversizedCount > 0
| sort by TimeGenerated desc;
// Stage 2: anomalous egress from router IPs post-exploitation
CommonSecurityLog
| where ipv4_is_in_any_range(SourceIP, RouterSubnets)
| where ipv4_is_private(DestinationIP) == false
| where DestinationPort !in (80, 443, 53, 123)  // exclude expected update/DNS/NTP traffic
| summarize Connections = count(), Ports = make_set(DestinationPort), Destinations = make_set(DestinationIP) by SourceIP, bin(TimeGenerated, 1h)
| where array_length(Destinations) > 2 or Connections > 20
| sort by TimeGenerated desc;

-- Hunt for exploitation tooling targeting Tenda /goform endpoints from managed hosts
LET proc_hunt = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '/goform/(SetFirewallCfg|[Ss]etFirewallCfg)'
   OR CommandLine =~ 'firewallEn='
   OR (CommandLine =~ '(curl|wget)' AND CommandLine =~ 'goform')

-- Shell history evidence of router targeting
LET hist_hunt = SELECT FullPath, rule(glob=FullPath) AS ShellFile,
       parse_file(filename=FullPath) AS History
FROM glob(globs=['/home/*/.bash_history', '/root/.bash_history', '/home/*/.zsh_history'])
WHERE History =~ 'goform|firewallEn|SetFirewallCfg'

SELECT * FROM proc_hunt
UNION ALL
SELECT NULL AS Pid, 'shell_history' AS Name, FullPath AS CommandLine,
       '' AS Exe, '' AS Username, NULL AS CreateTime
FROM hist_hunt

#!/bin/bash
# CVE-2026-113744 - Tenda AC19 exposure check and edge mitigation
set -euo pipefail

SUBNET="${1:-192.168.0.0/24}"
REPORT="cve-2026-113744-exposure-$(date +%F).txt"

echo "[+] Scanning $SUBNET for Tenda-style web management interfaces..." | tee "$REPORT"

# Identify hosts answering on common router mgmt ports with Tenda banners
for host in $(nmap -sn "$SUBNET" -oG - | awk '/Up$/{print $2}'); do
  banner=$(curl -sk --max-time 3 "http://$host/" | grep -iE 'tenda|AC19' || true)
  if [ -n "$banner" ]; then
    echo "[!] Possible Tenda device at $host" | tee -a "$REPORT"
    # Probe for the vulnerable handler (safe GET, no exploit payload)
    code=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 3 "http://$host/goform/SetFirewallCfg")
    echo "    /goform/SetFirewallCfg responded HTTP $code (reachable = vulnerable code path present)" | tee -a "$REPORT"
  fi
done

echo ""
echo "[+] Manual verification steps for each identified device:" | tee -a "$REPORT"
echo "    1. Log into the admin UI and confirm firmware version. 16.03.10.07 is VULNERABLE." | tee -a "$REPORT"
echo "    2. Check https://www.tendacn.com/us/download.html for AC19 firmware > 16.03.10.07." | tee -a "$REPORT"
echo "    3. If no patched firmware exists: DISABLE remote (WAN-side) web management immediately." | tee -a "$REPORT"
echo "    4. Restrict admin UI to a dedicated management VLAN/host via ACL." | tee -a "$REPORT"

# Edge mitigation: block WAN-side access to the vulnerable handler on a perimeter nginx reverse proxy
# (applies where management interfaces are published through a proxy)
cat <<'EOF' | tee -a "$REPORT"

[+] Example nginx mitigation (perimeter proxy in front of any published mgmt UI):
    location ~* /goform/SetFirewallCfg {
        deny all;
        return 403;
    }

[+] Example iptables mitigation on a Linux gateway in front of the IoT segment:
    iptables -A FORWARD -p tcp -d <router_ip> --dport 80 \
      -m string --string "/goform/SetFirewallCfg" --algo bm -j DROP
EOF

echo ""
echo "[+] Done. Review $REPORT and escalate any reachable /goform/SetFirewallCfg findings."