Tenda AC12 CVE-2026-19821

Exploitation requires low-privilege authentication to the Tenda AC12 httpd web management interface (PR:L per the CVSS 4.0 vector), meaning the attacker must possess valid login credentials for the router's web UI. The specific trigger is an HTTP request to the /goform/SetSysAutoRebbotCfg endpoint with an oversized rebootTime parameter value targeting the formSetRebootTimer function. No user interaction is required (UI:N) and no special attack prerequisites beyond credentials apply (AT:N, AC:L). The attack is network-reachable (AV:N), so any host able to reach the management interface over the network - LAN or, if misconfigured, WAN - with any valid credential satisfies all conditions. Devices with factory-default credentials unchanged are at substantially elevated risk, as the authentication barrier is effectively nullified. Exploitation is not limited to a specific platform or non-default feature flag; the endpoint is part of the standard httpd interface on the confirmed firmware version.

The CVSS 4.0 score of 7.4 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H reflects a remotely triggerable, low-complexity exploit with high impact on device confidentiality, integrity, and availability, bounded by a low-privilege authentication requirement (PR:L). The E:P modifier confirms a publicly available PoC, raising real-world exploitation likelihood above the baseline for unpatched devices. For a consumer router, 'low privilege' is a meaningful but thin barrier - devices with factory-default credentials are effectively equivalent to PR:N in practice. No EPSS score was provided in the input data, preventing probability-based comparison. No CISA KEV listing was identified, indicating no confirmed widespread active exploitation at time of analysis, though the PoC availability materially shortens the window before opportunistic use. The absence of scope change (SC:N/SI:N/SA:N) limits confirmed impact to the router itself, though full device compromise enables use as a network pivot or persistent implant. Overall: genuine priority for any network where this device model is deployed, particularly given consumer-device patch inertia.

An attacker who has obtained valid credentials to the Tenda AC12 web management interface - whether through default credential reuse, credential theft, or brute force - sends a crafted HTTP POST request to /goform/SetSysAutoRebbotCfg with an excessively long value for the rebootTime parameter. The formSetRebootTimer function copies this value into a fixed-size buffer without bounds checking, overflowing it and corrupting adjacent memory to redirect execution. A public PoC on GitHub documents this technique, meaning exploit steps are already available for adaptation by threat actors.