Which versions of Tenda W12 are affected by CVE-2026-10189?

Tenda W12 firmware version 3.0.0.7(4763) contains a buffer overflow vulnerability in its management interface that allows authenticated users to corrupt memory.

Is there a public PoC exploit available for CVE-2026-10189?

Yes, a public proof-of-concept exploit is available for CVE-2026-10189. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-10189?

Within 24 hours: Identify and catalog all Tenda W12 devices running firmware 3.0.0.7(4763); assess whether management interfaces are exposed to untrusted networks or remote users. Within 7 days: Restrict management interface access to administrative networks only via firewall rules; check Tenda support portal for available firmware updates beyond version 3.0.0.7(4763); implement VPN requirement for any remote management access. Within 30 days: Develop device replacement or alternative vendor evaluation plan; implement dedicated management VLAN with network segmentation; deploy log monitoring for exploitation attempts against the cgiSysTimeInfoSet handler.

Tenda W12 CVE-2026-10189

Q: What is the CVSS score of CVE-2026-10189?

CVE-2026-10189 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33511 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-31 VulDB

GHSA-r38j-2xmx-6hwh

Buffer Overflow Stack Overflow Tenda W12

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 31, 2026 - 16:30 vuln.today

v3 (cvss_changed)

Analysis Updated

May 31, 2026 - 16:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 31, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 31, 2026 - 16:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

May 31, 2026 - 15:45 vuln.today

DescriptionCVE.org

A vulnerability has been found in Tenda W12 3.0.0.7(4763). This vulnerability affects the function cgiSysTimeInfoSet of the file /bin/httpd. The manipulation of the argument sec leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows authenticated remote attackers to corrupt memory in the embedded HTTP daemon via the 'sec' parameter of the cgiSysTimeInfoSet handler. Publicly available exploit code exists for this issue, raising the practical risk for exposed management interfaces despite no public exploit identified at time of analysis in the CISA KEV catalog.

Technical ContextAI

The flaw resides in /bin/httpd, the embedded web management server bundled with Tenda W12 enterprise/AC wireless access point firmware. The vulnerable routine cgiSysTimeInfoSet handles NTP/time configuration submissions from the admin web UI and copies the 'sec' argument into a fixed-size stack buffer without proper bounds checking, matching CWE-121 (Stack-based Buffer Overflow). On typical MIPS/ARM SOHO firmware like Tenda's, such overflows overwrite the saved return address on a non-ASLR, often non-NX stack, making reliable control-flow hijacking feasible. The affected CPE is cpe:2.3:a:tenda:w12:*:*:*:*:*:*:*:* covering firmware 3.0.0.7(4763) as reported via VulDB.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published a fixed firmware build referenced in the available data. Until a firmware update is released via https://www.tenda.com.cn/, restrict access to the device's HTTP administrative interface to a dedicated management VLAN or trusted jump-host (blocking inbound TCP to the admin port from WAN and from general user VLANs), which directly removes the network-reachability prerequisite; the trade-off is that legitimate remote administration must move through a VPN or bastion. Rotate any default or shared admin credentials and enforce strong unique passwords to raise the bar on the PR:L requirement, and monitor /bin/httpd request logs for anomalous POSTs to cgiSysTimeInfoSet with oversized 'sec' values. Track VulDB advisory https://vuldb.com/vuln/367470 for fix availability.