EUVD-2026-33510
GHSA-jwrp-439h-fx3w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A flaw has been found in Tenda W12 3.0.0.7(4763). This affects the function cgistaKickOff of the file /bin/httpd. Executing a manipulation of the argument staMac can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.
AnalysisAI
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote attackers with low privileges to corrupt memory via the staMac parameter processed by the cgistaKickOff function in /bin/httpd. Publicly available exploit code exists (hosted at cdn2.v50to.cc), elevating practical risk despite no current CISA KEV listing. The CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact achievable over the network against this enterprise wireless access point.
Technical ContextAI
Tenda W12 is an enterprise-grade wireless access point whose embedded HTTP daemon (/bin/httpd) handles administrative CGI requests. The cgistaKickOff endpoint is intended to disconnect (kick off) wireless station clients identified by MAC address, but it copies the user-supplied staMac argument into a fixed-size stack buffer without adequate length validation, mapping to CWE-121 (Stack-based Buffer Overflow). On embedded MIPS/ARM router platforms like this, such overflows typically overwrite the saved return address on the stack, enabling control-flow hijack to attacker-supplied shellcode or ROP gadgets - exploitation is well-documented across the Tenda product line. The affected CPE is cpe:2.3:a:tenda:w12:*:*:*:*:*:*:*:*, with firmware 3.0.0.7(4763) specifically named.
RemediationAI
No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware version referenced in the available data, so monitor https://www.tenda.com.cn/ for a firmware update superseding 3.0.0.7(4763). As compensating controls, restrict access to the device's HTTP administrative interface to a dedicated management VLAN or trusted jump-host IPs via ACLs, which prevents remote reach to /bin/httpd at the cost of requiring out-of-band management for routine changes. Disable remote (WAN-side) web administration entirely if enabled, accepting the trade-off of needing on-site or VPN access for configuration. Rotate the admin credential to a strong unique value to raise the bar for satisfying the PR:L requirement, and if feasible replace the device with a supported model, since end-of-life consumer/SMB Tenda hardware often does not receive timely security fixes. Track third-party guidance at https://vuldb.com/vuln/367469.
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote attackers to corrupt memory in the embedde
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote authenticated attackers to corrupt memory
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows authenticated remote attackers to corrupt memory
Denial of service in Tenda W12 firmware 3.0.0.7(4763) allows a low-privileged remote attacker to crash the web managemen
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today