CVE-2026-10191 in W12
Summary
by MITRE • 05/31/2026
A vulnerability was determined in Tenda W12 3.0.0.7(4763). Impacted is the function cgiWifiMacFilterSet of the file /bin/httpd. This manipulation of the argument wifiMacFilterSet.macList.mac causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/01/2026
The vulnerability identified in Tenda W12 3.0.0.7(4763) represents a critical stack-based buffer overflow flaw within the web interface management functionality of the device. This vulnerability exists in the cgiWifiMacFilterSet function located in the /bin/httpd binary file, which handles wireless mac address filtering configuration parameters. The specific flaw occurs when processing the wifiMacFilterSet.macList.mac argument, where insufficient input validation allows maliciously crafted data to exceed the allocated buffer space on the stack. This particular implementation flaw falls under CWE-121 Stack-based Buffer Overflow, which is classified as a serious vulnerability category in the Common Weakness Enumeration catalog.
The operational impact of this vulnerability is severe as it enables remote code execution capabilities for attackers who can manipulate the wifiMacFilterSet.macList.mac parameter through HTTP requests to the affected device. Since the attack vector is remote and the exploit has been publicly disclosed, this creates an immediate threat landscape where unauthorized parties can potentially gain full control over the affected router. The stack-based buffer overflow allows for arbitrary code execution, which could lead to complete system compromise, data exfiltration, or the establishment of persistent backdoors. This vulnerability directly maps to ATT&CK technique T1210 - Exploitation of Remote Services, specifically targeting network infrastructure devices.
The technical exploitation of this vulnerability requires an attacker to send specially crafted HTTP requests containing oversized mac address lists to the web interface of the Tenda W12 device. When the device processes this malformed input through the cgiWifiMacFilterSet function, the excessive data overflows the stack buffer and potentially corrupts adjacent memory locations, including return addresses and function pointers. This memory corruption can be leveraged to redirect program execution flow to attacker-controlled code, effectively allowing full system compromise. The vulnerability's public disclosure status significantly increases the risk profile as automated exploitation tools may already exist in the threat landscape, making the device immediately exploitable by malicious actors without requiring advanced exploitation techniques.
Organizations and individuals using this affected Tenda W12 device should immediately implement mitigations including firmware updates from the vendor if available, network segmentation to isolate the device, and implementing firewall rules that restrict access to the web management interface. Network administrators should also consider disabling unnecessary services and implementing intrusion detection systems to monitor for exploitation attempts. The vulnerability demonstrates the critical importance of proper input validation and memory management in embedded networking devices, as these devices often serve as gateways to larger network infrastructures and their compromise can lead to widespread security breaches. Security teams should prioritize patch management for all network infrastructure devices and conduct thorough vulnerability assessments to identify similar flaws in other embedded systems within their environments.