Which versions of Tenda W12 are affected by CVE-2026-10192?

Tenda W12 devices running firmware 3.0.0.7(4763) contain a remote memory corruption vulnerability (CVE-2026-10192) accessible via the HTTP daemon; publicly available exploit code exists, creating…

Is there a public PoC exploit available for CVE-2026-10192?

Yes, a public proof-of-concept exploit is available for CVE-2026-10192. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-10192?

24 hours: Inventory all Tenda W12 devices in production, identifying those running firmware 3.0.0.7(4763) or earlier, and document network locations and criticality levels. 7 days: Implement network segmentation to isolate vulnerable devices from sensitive network segments; disable HTTP/HTTPS-based remote management if operationally feasible; deploy firewall ACLs to restrict administrative access. 30 days: Establish formal escalation with Tenda for patch timeline; upon patch release, deploy to all affected devices within 48 hours; if no patch timeline emerges within 30 days, initiate procurement of replacement devices from vendors with active security support.

Tenda W12 CVE-2026-10192

Q: What is the CVSS score of CVE-2026-10192?

CVE-2026-10192 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33514 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-31 VulDB

GHSA-hxxc-3ccm-q96j

Buffer Overflow Stack Overflow Tenda W12

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 31, 2026 - 17:28 vuln.today

v3 (cvss_changed)

Analysis Updated

May 31, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 31, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

May 31, 2026 - 17:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

May 31, 2026 - 16:50 vuln.today

DescriptionCVE.org

A vulnerability was identified in Tenda W12 3.0.0.7(4763). The affected element is the function set_local_time_0 of the file /bin/httpd. Such manipulation of the argument Time leads to stack-based buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote attackers to corrupt memory in the embedded HTTP daemon by supplying a crafted Time argument to the set_local_time_0 function in /bin/httpd. Publicly available exploit code exists, and the CVSS 4.0 base score of 7.4 reflects high impact to confidentiality, integrity, and availability with low-privilege network access. No CISA KEV listing or EPSS score is provided, so widespread opportunistic exploitation is not confirmed at this time.

Technical ContextAI

The Tenda W12 is an enterprise-grade wireless access point whose management interface is served by an embedded HTTP daemon (/bin/httpd) common to Tenda's MIPS/ARM-based SOHO and SMB networking products. CWE-121 (Stack-based Buffer Overflow) indicates that the set_local_time_0 handler copies the Time parameter into a fixed-size stack buffer without adequate bounds checking, so an oversized value overruns the saved return address and adjacent locals. Embedded Tenda httpd binaries historically lack modern mitigations such as stack canaries, NX, and ASLR on all segments, which makes stack-based overflows in these devices unusually amenable to control-flow hijacking and ROP-based code execution.

RemediationAI

No vendor-released patch identified at time of analysis; administrators should monitor https://www.tenda.com.cn/ for an updated W12 firmware image superseding 3.0.0.7(4763) and apply it as soon as it is published. Until a fix is available, restrict access to the device's HTTP management interface to a dedicated management VLAN or trusted admin workstations via ACLs, disable any WAN-side remote management option, and ensure the device is not reachable from the internet - recognizing the trade-off that remote administration workflows will be lost. Rotate the admin password to a strong unique value to raise the bar for the PR:L authentication requirement, and consider IPS signatures matching oversized Time parameters in POSTs to the time-setting endpoint of /bin/httpd; for high-risk deployments, replacing the device with a supported model is the most durable mitigation. Track the public exploit at http://cdn2.v50to.cc/set_local_time_0_overflow.zip only for detection-engineering purposes.