CVE-2026-10192
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In Tenda W12 version 3.0.0.7(4763), a stack-based buffer overflow exists in the set_local_time_0 function in /bin/httpd when manipulating the Time argument. Remote exploitation is possible. The exploit is public.
Risk Assessment
An attacker can remotely crash the router or potentially execute arbitrary code, leading to full compromise of the device and network.
Recommendation
Update the Tenda W12 firmware to the latest version. If no update is available, consider replacing the device.
Other vulnerabilities in Tenda W12
See all- CVE-2026-10191High
In Tenda W12 version 3.0.0.7(4763), a vulnerability exists in the cgiWifiMacFilterSet function of the /bin/httpd file. Manipulation of the wifiMacFilterSet.macList.mac argument leads to a stack-based buffer overflow, which can be exploited remotely. The exploit has been publicly disclosed.
- CVE-2026-10190Medium
A vulnerability was found in Tenda W12 3.0.0.7(4763). It affects the cgiSysWebTimeoutSet function in the file /bin/httpd of the Web Management Interface component. Manipulating the web_over_time argument results in denial of service. The attack can be launched remotely. The exploit has been made public.
- CVE-2026-10189High
A stack-based buffer overflow vulnerability was found in the cgiSysTimeInfoSet function in /bin/httpd of Tenda W12 router version 3.0.0.7(4763). Remote attack is possible by manipulating the sec argument. The exploit has been publicly disclosed.
- CVE-2026-10188High
In Tenda W12 version 3.0.0.7(4763), a vulnerability exists in the cgistaKickOff function of the /bin/httpd file. Manipulation of the staMac argument leads to a stack-based buffer overflow, which can be exploited remotely. The exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was identified in Tenda W12 3.0.0.7(4763). The affected element is the function set_local_time_0 of the file /bin/httpd. Such manipulation of the argument Time leads to stack-based buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.