CVE-2026-19924: Critical Tenda AC10 httpd Authentication Bypass (CVSS 9.8) — Detection and Remediation Guide

NVD has published CVE-2026-19924, a CVSS 9.8 (Critical) vulnerability in the Tenda AC10 router running firmware version 16.03.10.09_multi_TDE01. The flaw lives in the R7WebsSecurityHandler function of the router's embedded httpd web server and results in improper authentication — meaning an unauthenticated remote attacker can bypass the router's access controls over the network. The issue has been publicly disclosed, and public disclosure of IoT web-server authentication bypasses historically translates into automated exploitation within days, if not hours.

If you have Tenda AC10 devices anywhere in your environment — branch offices, remote worker homes, lab networks, or guest environments — treat this as an urgent exposure. Consumer-grade routers are precisely the class of device that gets absorbed into botnets, used as C2 relay infrastructure, or leveraged as an initial-access pivot into corporate networks via VPN-connected remote workers. A 9.8 unauthenticated remote bypass on an internet-facing management plane is the worst-case scenario for this device class.

Technical Analysis

Affected Products and Versions

How the Vulnerability Works

The R7WebsSecurityHandler function is the gatekeeper inside the router's httpd daemon responsible for deciding whether an incoming HTTP request to the administrative interface requires authentication and whether the presented session state is valid. The vulnerability allows manipulation of that decision path — in practical terms, an attacker can craft requests to the web management interface that the handler incorrectly treats as authorized.

From a defender's perspective, the attack chain looks like this:

1. Reconnaissance: The attacker identifies an exposed Tenda AC10 web management interface. Shodan-style scans make this trivial if remote administration (WAN-side management) is enabled, or the attacker reaches the LAN-side interface through another foothold or a malicious site driving browser-based requests.
2. Authentication bypass: A crafted request to the httpd service defeats the R7WebsSecurityHandler check, granting administrative-level access to the router's configuration endpoints without credentials.
3. Post-exploitation: With admin control, attackers typically change DNS settings (for pharming/credential interception), enable remote management for persistent access, flash malicious firmware configurations, or download and execute botnet payloads. Compromised consumer routers are routinely conscripted into DDoS botnets and proxy/C2 relay networks.

Because the vulnerability is in the request-handling path of httpd, exploitation leaves its primary traces in network traffic to the router's management ports and in anomalous behavior from the router itself afterward (unexpected outbound connections, DNS changes, config modification). Consumer router firmware rarely gives you endpoint telemetry — so your detection surface is the network layer and any upstream firewall, proxy, or NetFlow telemetry you control.

Exploitation Status

The NVD entry notes that the security issue has been publicly disclosed and may be used. That language should be read as: details sufficient to develop an exploit are in public circulation. There is no confirmed CISA KEV listing at the time of writing, but defenders should monitor the KEV catalog closely — Tenda vulnerabilities have a well-established track record of rapid KEV inclusion once weaponized. Assume exploitation is imminent and act on exposure reduction immediately, not after confirmation.

Detection & Response

The honest challenge here: you cannot install an EDR agent on a Tenda AC10. Detection must focus on (a) inbound attempts against the management interface, (b) post-compromise behavior of the router observable at the network layer, and (c) identifying where these devices exist in your estate in the first place.

SIGMA Rules

The following rules target web/proxy and firewall log sources. They are deliberately scoped to management-plane access patterns to keep false positives manageable.

---
title: External Access Attempt to SOHO Router Management Interface
id: 8c2f4a91-6b3d-4e57-9a21-7d5e1f3c8b02
status: experimental
description: Detects inbound connection attempts from external sources to common SOHO router web management ports, consistent with scanning or exploitation of CVE-2026-19924 against Tenda AC10 httpd.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19924
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: firewall
  product: network
detection:
  selection_ports:
    DestinationPort:
      - 80
      - 8080
      - 8443
      - 443
  selection_direction:
    Direction: inbound
  selection_action:
    Action: allowed
  filter_internal:
    SourceIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_ports and selection_direction and selection_action and not filter_internal
falsepositives:
  - Legitimate port-forwarded services on the perimeter
  - External vulnerability scanners operated by the organization
level: medium
---
title: SOHO Router Initiating Suspicious Outbound Connections
id: 3e7b9d52-1a48-4c63-bf74-2e6d9a5c1047
status: experimental
description: Detects router/infrastructure device IP addresses initiating outbound connections on ports commonly abused by IoT botnets for C2 and payload retrieval after compromise (e.g., following exploitation of CVE-2026-19924).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19924
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: firewall
  product: network
detection:
  selection_ports:
    DestinationPort:
      - 23
      - 2323
      - 6667
      - 4444
      - 5555
      - 31337
  selection_direction:
    Direction: outbound
  filter_expected:
    Action: blocked
  condition: selection_ports and selection_direction and not filter_expected
falsepositives:
  - Rare legitimate IRC or telnet usage in lab environments
level: high

KQL — Microsoft Sentinel

These queries assume firewall/NetFlow data ingested via CommonSecurityLog (CEF) or Syslog. The first hunts for external probes against router management ports; the second establishes a behavioral tripwire for compromised-router outbound activity. Scope the device IP list to your identified Tenda/IoT subnet for best signal.

// Hunt 1: External attempts to reach router management interfaces
// Tune RouterSubnet to your actual gateway/IoT addressing
let RouterSubnet = "192.168.0.0/24";
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where ipv4_is_in_subnet(DestinationIP, RouterSubnet)
| where DestinationPort in (80, 443, 8080, 8443)
| where not(ipv4_is_private(SourceIP))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by SourceIP, DestinationIP, DestinationPort, DeviceAction
| order by ConnectionCount desc;

// Hunt 2: Compromised-router behavior — outbound connections on botnet-typical ports
let RouterSubnet = "192.168.0.0/24";
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where ipv4_is_in_subnet(SourceIP, RouterSubnet)
| where not(ipv4_is_private(DestinationIP))
| where DestinationPort in (23, 2323, 6667, 4444, 5555, 31337)
   or (DestinationPort in (80, 443) and DeviceAction =~ "allowed")
| summarize ConnectionCount = count(), DistinctDests = dcount(DestinationIP)
  by SourceIP, DestinationPort
| where DistinctDests > 20 or DestinationPort in (23, 2323, 6667, 4444, 5555, 31337)
| order by DistinctDests desc;

Velociraptor VQL

Velociraptor cannot run on the router itself, but if you manage any Linux-based network infrastructure, jump hosts, or IoT gateways in the same segment, hunt for child processes spawned by web server processes — a classic post-exploitation artifact for httpd-class flaws where the web daemon is leveraged to execute payloads.

-- Hunt for web server processes spawning shells or downloaders (post-auth-bypass payload execution)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '^(sh|bash|dash|wget|curl|tftp|nc|ncat)$'
  AND (
    Ppid IN (
      SELECT Pid FROM pslist() WHERE Name =~ '(httpd|lighttpd|nginx|boa|goahead)'
    )
  )

Verification & Hardening Script

Use this on a management host to enumerate potentially vulnerable Tenda devices on your network and check whether management interfaces are exposed.

#!/bin/bash
# CVE-2026-19924 exposure check — Tenda AC10 httpd improper authentication
# Run from a management host with visibility into target subnets.
# Usage: ./tenda_ac10_check.sh <subnet CIDR, e.g. 192.168.1.0/24>

SUBNET="$1"
if [ -z "$SUBNET" ]; then
  echo "Usage: $0 <subnet CIDR>"
  exit 1
fi

echo "[*] Scanning $SUBNET for web management interfaces on common router ports..."
# Discover live hosts with open management ports
nmap -Pn -p 80,443,8080,8443 --open -oG - "$SUBNET" 2>/dev/null | \
  awk '/Ports:/{print $2, $4, $5}' | while read -r host ports; do
  echo "[+] Host with open mgmt port: $host $ports"
  # Grab HTTP server/banner and title to fingerprint Tenda httpd
  banner=$(curl -sk -m 5 -I "http://$host/" | grep -iE '^(Server|WWW-Authenticate):' | tr -d '\r')
  title=$(curl -sk -m 5 "http://$host/" | grep -oiE '<title>[^<]*</title>' | head -1)
  if echo "$banner $title" | grep -qiE 'tenda|ac10'; then
    echo "[!] POSSIBLE TENDA DEVICE IDENTIFIED at $host"
    echo "    Banner: $banner"
    echo "    Title:  $title"
    echo "    ACTION: Verify firmware. Vulnerable version: 16.03.10.09_multi_TDE01"
  fi
done

echo ""
echo "[*] Checking whether gateway management interface responds on WAN-side..."
GW=$(ip route | awk '/default/ {print $3; exit}')
echo "[*] Default gateway: $GW"
curl -sk -m 5 -o /dev/null -w "Gateway httpd HTTP status: %{http_code}\n" "http://$GW/"

echo ""
echo "[*] Remediation reminders:"
echo "    1. Confirm firmware version via admin UI (System Status / Firmware)."
echo "    2. If running 16.03.10.09_multi_TDE01 -> check Tenda support site for fixed release."
echo "    3. Disable remote (WAN-side) web management immediately."
echo "    4. Restrict LAN-side admin access to a dedicated management VLAN/host."
echo "    5. Change admin credentials and verify DNS settings have not been tampered with."

Remediation

1. Verify and patch firmware. Log into the AC10 admin UI and confirm the running firmware. If it is 16.03.10.09_multi_TDE01, the device is vulnerable. Check Tenda's official support portal for an updated firmware release addressing CVE-2026-19924 and apply it immediately. Reference the NVD entry for tracking: https://nvd.nist.gov/vuln/detail/CVE-2026-19924
2. Disable WAN-side remote management. This is the single highest-impact mitigation and should be done today regardless of patch status. A network-exploitable auth bypass that cannot be reached from the internet is a dramatically smaller problem. Verify from an external vantage point that ports 80/443/8080/8443 on your public IPs do not answer.
3. Segment and restrict LAN-side access. IoT and consumer routing gear should live on a dedicated VLAN. Restrict access to the management interface to specific administrator hosts using firewall ACLs. Never allow general user VLANs to reach router admin ports.
4. Audit for prior compromise. Because details are public, assume any internet-exposed vulnerable device may already be compromised. Check for: changed DNS server settings, unknown admin accounts, enabled remote management you didn't configure, unfamiliar port-forwarding rules, and modified scheduled tasks. When in doubt, factory-reset the device, apply updated firmware, and reconfigure from scratch with a strong unique admin password.
5. Monitor for KEV inclusion. Track the CISA Known Exploited Vulnerabilities catalog. If CVE-2026-19924 is added, federal and KEV-aligned remediation deadlines will apply, and exploitation will be confirmed rather than probable.
6. Plan for end-of-life replacement. If Tenda does not ship a fix promptly, replace the device. A CVSS 9.8 unauthenticated remote bypass on a network boundary device with no patch is not a risk you accept — it is a risk you remove. This should also trigger a broader review of consumer-grade networking hardware anywhere it touches your environment, particularly for remote workers on corporate VPNs.

Bottom Line

CVE-2026-19924 is a textbook example of why SOHO and IoT edge devices remain the soft underbelly of enterprise defense: unauthenticated remote code-level access to the management plane of a device with no endpoint telemetry, no EDR, and infrequent patching. Your exposure window is measured from public disclosure — which has already happened. Inventory these devices now, kill WAN-side management, segment aggressively, and patch or replace.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub