CVE-2026-10189 in W12
Summary
by MITRE • 05/31/2026
A vulnerability has been found in Tenda W12 3.0.0.7(4763). This vulnerability affects the function cgiSysTimeInfoSet of the file /bin/httpd. The manipulation of the argument sec leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/31/2026
This vulnerability exists in the Tenda W12 router firmware version 3.0.0.7(4763) where the cgiSysTimeInfoSet function within the /bin/httpd binary contains a stack-based buffer overflow flaw. The specific trigger occurs when manipulating the sec argument parameter, which allows an attacker to overwrite adjacent memory locations on the stack. This type of vulnerability falls under CWE-121 Stack-based Buffer Overflow, representing a critical security weakness that can lead to arbitrary code execution. The function operates within the web server component of the router's firmware, making it accessible through network-based attacks without requiring physical access to the device.
The remote exploitation capability of this vulnerability means that attackers can initiate the attack from outside the local network, potentially targeting unpatched routers exposed to the internet. This represents a significant risk given that many consumer and small business routers remain unpatched due to user inaction or lack of awareness. The buffer overflow occurs when the sec argument exceeds the allocated stack buffer size, allowing an attacker to overwrite return addresses and control the instruction pointer. According to ATT&CK framework technique T1210, this vulnerability could be leveraged for privilege escalation and persistent access to affected networks.
The operational impact of this vulnerability extends beyond simple remote code execution, as it can provide attackers with complete control over the affected router. Once exploited, an attacker could modify network configurations, redirect traffic through malicious servers, or establish backdoors for continued access. The stack-based nature of the overflow means that the attack surface is limited to the specific function parameters and does not require complex memory corruption techniques. However, the fact that this exploit has been publicly disclosed increases the likelihood of automated attacks targeting vulnerable devices. Organizations should immediately assess their network exposure to such vulnerabilities and implement appropriate mitigations including firmware updates, network segmentation, and monitoring for unusual traffic patterns. The vulnerability demonstrates the importance of proper input validation and secure coding practices in embedded systems where resource constraints often lead to insufficient security measures.