Tenda W12 CVE-2026-10190

Low-privilege authentication to the Tenda W12 Web Management Interface is required, as confirmed by CVSS PR:L. The attacker must have valid credentials (even low-privilege/guest-tier) for the router's HTTP management daemon at /bin/httpd. The web management interface must be network-accessible - by default this is LAN-accessible, and the attack is also viable over WAN if the remote management feature has been manually enabled (a non-default configuration). No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race condition or special timing is needed beyond submitting the crafted request. Exploitation is limited by the PR:L authentication requirement; however, SOHO routers frequently retain factory-default credentials, which practically reduces this barrier. The impact is confined to availability - there is no privilege escalation or data exposure path present in the described vulnerability.

The CVSS 3.1 base score of 6.5 reflects network-reachable (AV:N), low-complexity (AC:L), low-privilege (PR:L) exploitation with high availability impact and no confidentiality or integrity loss. The temporal modifiers reinforce moderate urgency: E:P confirms a proof-of-concept exists, RL:X indicates no remediation level has been established (consistent with no observed vendor patch), and RC:R indicates reasonable but not definitive confidence in the vulnerability details. No EPSS score was provided, and the vulnerability is not in CISA KEV, suggesting no confirmed widespread or targeted active exploitation at time of analysis. The real-world risk is moderate for consumer and SMB environments: while the exploit requires low-privilege credentials, many SOHO router deployments use weak or default credentials, effectively lowering the bar. The impact is limited to availability - there is no code execution or data disclosure path indicated. Organizations with Tenda W12 devices exposed via remote management on WAN interfaces face elevated risk.

An attacker authenticated to the Tenda W12 web management interface with low-privilege credentials - potentially obtained via default or guessed credentials - sends a crafted HTTP POST or GET request to the cgiSysWebTimeoutSet endpoint with a malformed or oversized 'web_over_time' parameter value. The /bin/httpd process fails to properly handle or release the associated resource, causing it to crash or hang. The router's management interface becomes unavailable, and depending on the implementation, the device may require a physical reboot to restore connectivity. A proof-of-concept exploit archive (cgiSysWebTimeoutSet_dos.zip) has been publicly released, making this attack trivially reproducible.