EUVD-2026-33511
GHSA-r38j-2xmx-6hwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed Tenda W12 admin UI
-
DeliveryObtain low-privileged web credentials
-
ExploitSend crafted POST to cgiSysTimeInfoSet with oversized sec parameter
-
InstallOverflow stack buffer in /bin/httpd
-
C2Hijack saved return address
-
ExecuteExecute attacker-controlled payload as httpd
-
ImpactPersist on device and pivot into LAN
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Network reachability to the Tenda W12 administrative HTTP daemon (/bin/httpd) is required, plus a low-privileged authenticated session on the web UI (CVSS PR:L) capable of invoking the cgiSysTimeInfoSet handler that processes the time-setting 'sec' argument. No user interaction is required (UI:N) and complexity is low (AC:L/AT:N), so once those conditions are met exploitation is straightforward. Exploitation is limited to devices running firmware 3.0.0.7(4763) where the web management interface is reachable from the attacker's network position; deployments that confine the admin UI to a trusted management network or that have rotated default credentials materially reduce real-world exposure. |
| Impact | CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N indicates network reachability with low complexity but requires low privileges, and the E:P sub-vector reflects that proof-of-concept exploit code is available (the cgiSysTimeInfoSet_overflow.zip archive distributed via a third-party CDN). Confidentiality, integrity, and availability impacts are all High on the vulnerable component, but Scope-Changed metrics are all None, so blast radius is limited to the device itself. The vulnerability is not listed in CISA KEV and no EPSS score was provided in the input data; risk should therefore be considered moderate-to-high for any W12 unit whose web admin is reachable from untrusted networks, but lower where management is restricted to a trusted LAN. The PR:L requirement means a valid (even low-privileged) admin credential is needed, which limits mass opportunistic exploitation but is a low bar on SOHO/enterprise APs that frequently ship with default or weak credentials. |
| Exploit ScenarioDerived | An attacker with low-privileged admin access (or default credentials) to a network-reachable Tenda W12 sends a crafted HTTP request to the time-configuration endpoint with an overlong 'sec' parameter, overflowing the stack buffer inside cgiSysTimeInfoSet and overwriting the saved return address to redirect execution into shellcode or a ROP chain. Because a public exploit archive (cgiSysTimeInfoSet_overflow.zip) has been published, the barrier to weaponization is low; successful exploitation yields code execution as the httpd process, typically root on these embedded devices, enabling persistent device takeover and pivoting into the wireless network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – May 31, 2026
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows authenticated remote attackers to corrupt memory in the embedded HTTP daemon via the 'sec' parameter of the cgiSysTimeInfoSet handler. Publicly available exploit code exists for this issue, raising the practical risk for exposed management interfaces despite no public exploit identified at time of analysis in the CISA KEV catalog.
Earlier versions of this analysis (2)
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows authenticated remote attackers to corrupt memory via the 'sec' parameter handled by the cgiSysTimeInfoSet function in /bin/httpd, potentially achieving arbitrary code execution on the device. Publicly available exploit code exists (hosted at cdn2.v50to.cc), increasing the likelihood of opportunistic exploitation against exposed management interfaces. No vendor-released patch identified at time of analysis, and the issue is not currently listed in CISA KEV.
Stack-based buffer overflow in the Tenda W12 wireless access point (firmware 3.0.0.7(4763)) allows remote authenticated attackers to corrupt memory in the embedded HTTP daemon by sending a crafted sec argument to the cgiSysTimeInfoSet handler in /bin/httpd. Publicly available exploit code exists (hosted on cdn2.v50to.cc and indexed by VulDB), and the CVSS 8.8 vector indicates high impact to confidentiality, integrity, and availability, though no public exploit identified in CISA KEV at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis - Tenda has not published a fixed firmware build referenced in the available data. Until a firmware update is released via https://www.tenda.com.cn/, restrict access to the device's HTTP administrative interface to a dedicated management VLAN or trusted jump-host (blocking inbound TCP to the admin port from WAN and from general user VLANs), which directly removes the network-reachability prerequisite; the trade-off is that legitimate remote administration must move through a VPN or bastion. Rotate any default or shared admin credentials and enforce strong unique passwords to raise the bar on the PR:L requirement, and monitor /bin/httpd request logs for anomalous POSTs to cgiSysTimeInfoSet with oversized 'sec' values. Track VulDB advisory https://vuldb.com/vuln/367470 for fix availability.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in /bin/httpd, the embedded web management server bundled with Tenda W12 enterprise/AC wireless access point firmware. The vulnerable routine cgiSysTimeInfoSet handles NTP/time configuration submissions from the admin web UI and copies the 'sec' argument into a fixed-size stack buffer without proper bounds checking, matching CWE-121 (Stack-based Buffer Overflow). On typical MIPS/ARM SOHO firmware like Tenda's, such overflows overwrite the saved return address on a non-ASLR, often non-NX stack, making reliable control-flow hijacking feasible. The affected CPE is cpe:2.3:a:tenda:w12:*:*:*:*:*:*:*:* covering firmware 3.0.0.7(4763) as reported via VulDB.
Know when W12 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in Tenda W12 3.0.0.7(4763). This vulnerability affects the function cgiSysTimeInfoSet of the file /bin/httpd. The manipulation of the argument sec leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Tenda W12 firmware version 3.0.0.7(4763) contains a buffer overflow vulnerability in its management interface that allows authenticated users to corrupt memory. Publicly available exploit code exists for this vulnerability, significantly elevating practical exploitation risk. Organizations using these devices face potential network infrastructure compromise and service disruption if management interface access is inadequately restricted.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict HTTP management daemon access to trusted administrative networks only via firewall rules; (2) Require VPN for all remote management connections; (3) Enable multi-factor authentication on all administrative accounts; (4) Implement network segmentation isolating management traffic from user networks; (5) Monitor HTTP daemon logs for suspicious requests containing 'sec' parameter; (6) Disable management interface if operations do not require it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote attackers to corrupt memory in the embedde
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote authenticated attackers to corrupt memory
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote attackers with low privileges to corrupt m
Denial of service in Tenda W12 firmware 3.0.0.7(4763) allows a low-privileged remote attacker to crash the web managemen
Exploit-DB