EUVD-2026-33513
GHSA-w35x-2v63-7ggc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed W12 admin panel
-
DeliveryObtain low-privilege web credentials
-
ExploitSend crafted POST to cgiWifiMacFilterSet
-
ExecutionOverflow stack buffer in /bin/httpd
-
PersistHijack control flow as root
-
ImpactPersist via firmware/config changes
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must reach the W12 HTTP management interface over the network and authenticate at low privilege (CVSS PR:L) to invoke the cgiWifiMacFilterSet handler in /bin/httpd with a malformed wifiMacFilterSet.macList.mac argument; no user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is limited to devices running Tenda W12 firmware 3.0.0.7(4763) where the management web service is reachable from the attacker's network position - typically a LAN, management VLAN, or an internet-exposed admin panel - and where valid (or default) credentials for the admin web UI are obtainable. Deployments that confine the web UI to an out-of-band management network and enforce strong unique admin passwords materially limit exploitability. |
| Impact | CVSS 4.0 scores this 7.4 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, indicating network-reachable, low-complexity exploitation that requires low-level authentication and yields high confidentiality, integrity, and availability impact on the vulnerable component with no scope change. The E:P (Proof-of-Concept) exploit maturity is corroborated by the publicly hosted exploit archive referenced in the advisory, which materially raises opportunistic-attacker risk. There is no CISA KEV listing and no EPSS score was supplied, so widespread mass exploitation cannot be confirmed; however, the description states PR:L while many Tenda admin panels ship with weak or default credentials, which can effectively collapse the authentication barrier in real deployments. The reporter is VulDB (a third-party aggregator) rather than Tenda PSIRT, so vendor confirmation of impact and a patch are not evidenced in the supplied data - defenders should treat the bug as credibly exploitable on exposed devices but verify with Tenda before assuming a fix exists. |
| Exploit ScenarioDerived | An attacker with low-privileged access to the W12 management interface - for example via guest admin credentials, a captured session, or default passwords on an internet-exposed device - sends a crafted HTTP POST to the cgiWifiMacFilterSet endpoint containing an oversized wifiMacFilterSet.macList.mac value, overflowing the stack buffer in /bin/httpd. Using the publicly disclosed exploit archive (cgiWifiMacFilterSet_overflow.zip) as a starting point, the attacker can crash the daemon for denial of service or, with successful return-address control, execute arbitrary code as root on the access point. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – May 31, 2026
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote authenticated attackers to corrupt memory in the embedded HTTP daemon by supplying an oversized wifiMacFilterSet.macList.mac parameter to the cgiWifiMacFilterSet handler in /bin/httpd. Publicly available exploit code exists, raising the practical risk of device compromise, denial of service, or potential code execution on affected access points, though no CISA KEV listing or active exploitation has been confirmed.
Earlier versions of this analysis (2)
Stack-based buffer overflow in Tenda W12 3.0.0.7(4763) firmware's cgiWifiMacFilterSet function within /bin/httpd allows remote attackers with low-level privileges to corrupt memory by submitting a crafted wifiMacFilterSet.macList.mac parameter. Publicly available exploit code exists (hosted at cdn2.v50to.cc), increasing the practical risk to exposed devices, though there is no public exploit identified at time of analysis indicating active in-the-wild use. The flaw affects an enterprise/SMB-grade wireless router and can result in arbitrary code execution or denial of service on the device.
Stack-based buffer overflow in the Tenda W12 router (firmware 3.0.0.7(4763)) allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by sending crafted input to the wifiMacFilterSet.macList.mac parameter handled by the cgiWifiMacFilterSet function in /bin/httpd. Publicly available exploit code exists per VulDB disclosure, and the CVSS 8.8 (high) rating reflects network-reachable exploitation with low complexity. No CISA KEV listing or EPSS data was provided, so this is not confirmed actively exploited despite the public POC.
RemediationAI
No vendor-released patch identified at time of analysis - the references include only VulDB advisory pages and an exploit archive, with no Tenda security bulletin enumerated. Until Tenda publishes fixed firmware, operators should restrict access to the W12 web management interface to a dedicated management VLAN or trusted admin workstations and block the httpd listener from WAN and untrusted user networks at the perimeter firewall, accepting that this prevents legitimate remote administration. Replace any default or shared administrator credentials with strong unique passwords to raise the bar for the PR:L authentication requirement, monitor for inbound requests to the cgiWifiMacFilterSet endpoint on /bin/httpd, and consult https://www.tenda.com.cn/ and https://vuldb.com/vuln/367472 periodically for an official firmware update; in regulated or high-risk environments, consider replacing the device if no patch becomes available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda W12 is an enterprise-class wireless access point whose web management interface is served by an embedded httpd binary written in C. The vulnerable cgiWifiMacFilterSet function parses MAC address entries supplied through the WiFi MAC filter configuration endpoint and writes them into a fixed-size stack buffer without adequate length validation, matching the CWE-121 (Stack-based Buffer Overflow) root cause class. As is typical in Tenda's MIPS/ARM-based SOHO firmware, the httpd process runs with root privileges and is statically linked, often without modern exploit mitigations such as stack canaries, ASLR, or non-executable stacks on every segment, making memory-corruption bugs in cgi handlers viable paths to control-flow hijack. The CPE cpe:2.3:a:tenda:w12 confirms the issue is scoped to the W12 product line.
Know when W12 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in Tenda W12 3.0.0.7(4763). Impacted is the function cgiWifiMacFilterSet of the file /bin/httpd. This manipulation of the argument wifiMacFilterSet.macList.mac causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Executive ViewAI
Tenda W12 wireless access points running firmware 3.0.0.7(4763) contain a memory corruption vulnerability in the HTTP daemon that enables remote compromise of affected devices. With publicly available exploit code in circulation, organizations face imminent risk of access point takeover, network denial of service, and potential lateral movement into corporate network infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to HTTP daemon services using firewall rules; (2) Implement network segmentation to isolate affected devices from critical systems; (3) Enable detailed logging and monitoring of HTTP daemon access for threat detection; (4) Disable remote management protocols if operationally feasible; (5) Maintain updated asset inventory for rapid incident response if exploitation is detected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote attackers to corrupt memory in the embedde
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows authenticated remote attackers to corrupt memory
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote attackers with low privileges to corrupt m
Denial of service in Tenda W12 firmware 3.0.0.7(4763) allows a low-privileged remote attacker to crash the web managemen
Exploit-DB