The CVE describes a heap-based buffer overflow in the saveParentControlInfo function exposed through the /goform/saveParentControlInfo endpoint on the Tenda AC19 firmware. By manipulating the deviceId argument, an attacker can corrupt data stored on the heap during a remote request. The description explicitly notes that the overflow may be exploited, but it does not specify the exact consequences such as code execution or denial of service, so the impact should be reported only as a memory corruption vulnerability.

The vulnerability affects the Tenda AC19 router with firmware version 16.03.10.07. No other products or versions are mentioned in the provided data.

The CVSS score is 10, indicating critical severity. No EPSS data is available, and the issue is not listed in the CISA KEV catalog, but the fact that it can be triggered remotely and is publicly disclosed implies a high likelihood that an attacker with modest technical skill could attempt to exploit it. The risk is therefore considered high, though the exact exploitation outcome is undefined in the vendor statement.