EUVD-2026-33510
GHSA-jwrp-439h-fx3w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed W12 admin interface
-
DeliveryAuthenticate with low-privilege or default credentials
-
ExploitSend crafted POST to cgistaKickOff with oversized staMac
-
InstallOverflow stack buffer in /bin/httpd
-
C2Hijack saved return address to shellcode
-
ExecuteExecute commands as httpd (typically root)
-
ImpactPivot into internal wireless network
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the W12 administrative HTTP daemon (/bin/httpd) and low-privilege authenticated access to the web management interface (CVSS PR:L), meaning the attacker must possess valid credentials of at least an unprivileged management role. The target must be running firmware 3.0.0.7(4763) on the W12 platform, and the attacker must reach the cgistaKickOff CGI endpoint with a controllable staMac argument. Limiting factors: admin/management interface is typically LAN-only by default and authentication is enforced, so devices with WAN-side admin disabled and non-default credentials are not exposed to opportunistic internet-wide exploitation; however, devices left with default or weak credentials effectively reduce the PR:L barrier to near-zero. |
| Impact | Risk signals are mixed but lean toward elevated practical concern. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates network-reachable, low-complexity exploitation with high impact across all three CIA pillars, requiring only low-level privileges. Exploit maturity is marked E:P (Proof-of-Concept), and a downloadable PoC zip is publicly hosted, materially raising opportunistic risk. No EPSS score was supplied with this input, and the vulnerability is not currently in CISA KEV - exploitation is not confirmed in the wild. The PR:L requirement (authenticated user) is the principal limiting factor; however, Tenda routers are frequently deployed with weak or default admin credentials, which can effectively collapse this barrier. No vendor advisory is referenced - verify affected scope with Tenda directly. |
| Exploit ScenarioDerived | An attacker with low-privilege credentials to the W12 web UI (or who has obtained them via default/weak password reuse) sends a crafted HTTP request to the cgistaKickOff handler with an oversized staMac parameter, overflowing the stack buffer in /bin/httpd. Using the publicly available PoC archive, the attacker overwrites the saved return address to redirect execution to embedded shellcode, gaining code execution as the httpd process - typically root on this class of device - and pivoting into the internal wireless network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – May 31, 2026
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote attackers with low privileges to corrupt memory via the staMac parameter processed by the cgistaKickOff function in /bin/httpd. Publicly available exploit code exists (hosted at cdn2.v50to.cc), elevating practical risk despite no current CISA KEV listing. The CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact achievable over the network against this enterprise wireless access point.
Earlier versions of this analysis (2)
Stack-based buffer overflow in Tenda W12 wireless access point firmware 3.0.0.7(4763) allows remote authenticated attackers to corrupt memory via the staMac parameter handled by the cgistaKickOff function in /bin/httpd. Publicly available exploit code exists, raising the risk of opportunistic attacks against exposed management interfaces, though no CISA KEV listing or vendor patch has been published at the time of analysis.
Stack-based buffer overflow in Tenda W12 wireless access point firmware 3.0.0.7(4763) allows authenticated remote attackers to corrupt memory and likely achieve code execution by submitting a manipulated staMac parameter to the cgistaKickOff function in /bin/httpd. Publicly available exploit code exists for this vulnerability, with VulDB reporting an EPSS-relevant POC distributed via a downloadable archive, though it is not currently listed in CISA KEV. The CVSS 3.1 score of 8.8 reflects network reachability with low complexity against a typical SOHO/enterprise wireless device that is frequently exposed to internal and occasionally external networks.
RemediationAI
No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware version referenced in the available data, so monitor https://www.tenda.com.cn/ for a firmware update superseding 3.0.0.7(4763). As compensating controls, restrict access to the device's HTTP administrative interface to a dedicated management VLAN or trusted jump-host IPs via ACLs, which prevents remote reach to /bin/httpd at the cost of requiring out-of-band management for routine changes. Disable remote (WAN-side) web administration entirely if enabled, accepting the trade-off of needing on-site or VPN access for configuration. Rotate the admin credential to a strong unique value to raise the bar for satisfying the PR:L requirement, and if feasible replace the device with a supported model, since end-of-life consumer/SMB Tenda hardware often does not receive timely security fixes. Track third-party guidance at https://vuldb.com/vuln/367469.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tenda W12 is an enterprise-grade wireless access point whose embedded HTTP daemon (/bin/httpd) handles administrative CGI requests. The cgistaKickOff endpoint is intended to disconnect (kick off) wireless station clients identified by MAC address, but it copies the user-supplied staMac argument into a fixed-size stack buffer without adequate length validation, mapping to CWE-121 (Stack-based Buffer Overflow). On embedded MIPS/ARM router platforms like this, such overflows typically overwrite the saved return address on the stack, enabling control-flow hijack to attacker-supplied shellcode or ROP gadgets - exploitation is well-documented across the Tenda product line. The affected CPE is cpe:2.3:a:tenda:w12:*:*:*:*:*:*:*:*, with firmware 3.0.0.7(4763) specifically named.
Know when W12 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Tenda W12 3.0.0.7(4763). This affects the function cgistaKickOff of the file /bin/httpd. Executing a manipulation of the argument staMac can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.
Executive ViewAI
Tenda W12 wireless access point firmware versions 3.0.0.7(4763) and earlier contain a high-severity vulnerability allowing remote code execution; publicly available exploit code exists, creating immediate exploitation risk. Attackers with low-level network access can compromise these devices, potentially affecting all connected systems and network data integrity. Organizations using these devices require immediate mitigation pending vendor patches.
No vendor-released patch identified at time of analysis. Interim mitigations: Implement network segmentation isolating affected access points from critical infrastructure; restrict administrative access via network access control lists; enable comprehensive logging and monitoring of access point activity; maintain alternative access point infrastructure for critical network zones; establish rapid deployment procedures for firmware patches when released by vendor.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote attackers to corrupt memory in the embedde
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote authenticated attackers to corrupt memory
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows authenticated remote attackers to corrupt memory
Denial of service in Tenda W12 firmware 3.0.0.7(4763) allows a low-privileged remote attacker to crash the web managemen
Exploit-DB