CVE-2026-10192 in W12
Summary
by MITRE • 05/31/2026
A vulnerability was identified in Tenda W12 3.0.0.7(4763). The affected element is the function set_local_time_0 of the file /bin/httpd. Such manipulation of the argument Time leads to stack-based buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/01/2026
The vulnerability in Tenda W12 3.0.0.7(4763) represents a critical stack-based buffer overflow condition within the web server component of the device. This flaw exists in the set_local_time_0 function located in the /bin/httpd binary file, which serves as the primary HTTP server implementation for the router's web interface. The vulnerability stems from insufficient input validation when processing the Time argument parameter, creating an exploitable condition where maliciously crafted input can overwrite adjacent memory locations on the stack. The function's failure to properly bounds-check the Time parameter allows attackers to inject excessive data that exceeds the allocated buffer space, potentially leading to arbitrary code execution or system crash.
The remote exploitation capability of this vulnerability significantly amplifies its threat level, as attackers can leverage this flaw from outside the local network without requiring physical access or prior authentication. The publicly available exploit demonstrates that this vulnerability is not merely theoretical but actively being used in the wild, making it a pressing concern for affected users. The nature of the buffer overflow allows for potential privilege escalation and complete system compromise, as the web server typically runs with elevated privileges to manage network configuration settings and system resources. This vulnerability directly maps to CWE-121 Stack-based Buffer Overflow, which is classified as a high-risk category under the Common Weakness Enumeration framework, and aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter.
The operational impact of this vulnerability extends beyond simple device compromise, as it enables attackers to gain persistent access to the network infrastructure. Once exploited, the attacker can manipulate network settings, intercept traffic, establish backdoors, or use the device as a pivot point for further attacks within the local network. The web interface serves as the primary attack surface for this vulnerability, making all administrative functions and network configuration accessible to unauthorized parties. Given that many users do not regularly update their router firmware, this vulnerability remains active in numerous deployments across different organizations and residential networks. The exploitation process typically involves crafting a malicious HTTP request containing oversized Time parameter values that trigger the buffer overflow condition, potentially resulting in denial of service or complete system takeover. Organizations should immediately implement network segmentation, disable unnecessary web services, and deploy network monitoring to detect exploitation attempts, while also prioritizing firmware updates to remediate this critical vulnerability.