Six SOHO router CVEs, Oct 20–22. Four CVSS 10.0s. All have public PoCs. None has a documented patch.
Tenda AC19 (CVE-2026-113744, formSetFirewallCfg stack overflow), TOTOLINK EX200 ×2 (CVE-2026-114382/383, cstecgi.cgi stack overflows), TOTOLINK A950RG (CVE-2026-114575, UploadCustomModule command injection), Tenda BE3L Pro 9.9, D-Link DHP-W610AV 9.8 — EOL since Nov 2025, D-Link says retire it.
The A950RG Boa config sets User=root. Every exploit on that device is a root shell.
Block management at WAN. Retire the D-Link. Isolate the rest.
https://threataft.com/articles/soho-router-october-2026-roundup-tenda-totolink-dlink
ThreatAftSOHO Router Roundup: Four 10.0s, No Patches | ThreatAftOctober SOHO router roundup: Tenda AC19, TOTOLINK EX200 ×2, A950RG, D-Link DHP-W610AV, BE3L Pro. Four CVSS 10.0s, public PoCs, almost no fixes.