CVE-2026-10190 in W12
Summary
by MITRE • 05/31/2026
A vulnerability was found in Tenda W12 3.0.0.7(4763). This issue affects the function cgiSysWebTimeoutSet of the file /bin/httpd of the component Web Management Interface. The manipulation of the argument web_over_time results in denial of service. It is possible to launch the attack remotely. The exploit has been made public and could be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/22/2026
This vulnerability exists within the Tenda W12 3.0.0.7(4763) router firmware where the web management interface contains a critical flaw in the cgiSysWebTimeoutSet function located in the /bin/httpd binary file. The specific issue occurs when processing the web_over_time argument parameter, which allows an attacker to manipulate this input value to trigger a denial of service condition. The vulnerability is particularly concerning as it operates through the web management interface, making it remotely exploitable without requiring physical access to the device. This represents a significant security risk for network administrators who rely on remote management capabilities for their network infrastructure.
The technical exploitation of this vulnerability falls under CWE-400, which categorizes it as an Uncontrolled Resource Consumption vulnerability. When an attacker sends malicious input to the web_over_time parameter, the system fails to properly validate or sanitize this input before processing it within the cgiSysWebTimeoutSet function. This lack of proper input validation creates an opportunity for resource exhaustion or process termination that results in the denial of service condition. The attack vector is classified as remote since the web management interface is accessible over the network, allowing unauthorized users to exploit the flaw from outside the local network perimeter.
The operational impact of this vulnerability extends beyond simple service interruption as it can severely compromise network availability and management capabilities. Network administrators who depend on remote access to configure and monitor their Tenda W12 devices may find themselves unable to perform critical management functions when the vulnerability is exploited. This denial of service condition could persist until the device is manually rebooted or the firmware is updated, creating potential downtime for network operations. The public availability of the exploit means that any attacker with basic technical knowledge can leverage this vulnerability, making it particularly dangerous in production environments where network reliability is paramount.
Mitigation strategies should focus on immediate firmware updates from Tenda to address the specific vulnerability in the cgiSysWebTimeoutSet function. Network administrators should also implement network segmentation to limit access to the web management interface, restrict access based on trusted IP addresses, and consider disabling remote management features when not actively required. The ATT&CK framework categorizes this vulnerability under T1190 - Exploit Public-Facing Application, highlighting the need for proper network access controls and application hardening measures. Additionally, implementing network monitoring solutions to detect unusual traffic patterns or repeated connection attempts to the web management interface can help identify exploitation attempts before they succeed in causing service disruption.