CVE-2026-10192

Vulnerability

A stack-based buffer overflow vulnerability exists in the set_local_time_0 function within the /bin/httpd binary of Tenda W12 routers running firmware version 3.0.0.7(4763). The overflow occurs when processing the Time argument, allowing an attacker to corrupt adjacent memory.

Exploitation

The attack can be launched remotely without authentication. An attacker sends a specially crafted HTTP request to the vulnerable endpoint with an overly long Time parameter, triggering the buffer overflow. Public exploit code is available, facilitating exploitation.

Impact

Successful exploitation can lead to arbitrary code execution in the context of the httpd process, potentially gaining full control over the affected device. This may result in complete compromise of confidentiality, integrity, and availability.

Mitigation

As of the publication date, no official fix has been released by Tenda [1]. Users should monitor the vendor's website for firmware updates. Until a patch is available, consider restricting network access to the device or disabling remote management.