EUVD-2026-33514
GHSA-hxxc-3ccm-q96j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed Tenda W12 mgmt interface
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend crafted Time argument to /bin/httpd
-
InstallTrigger stack overflow in set_local_time_0
-
C2Hijack saved return address
-
ExecuteExecute code as httpd
-
ImpactPivot into wireless LAN
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Tenda W12's HTTP management daemon (/bin/httpd) on an affected device running firmware 3.0.0.7(4763), plus low-privilege credentials to the web UI as indicated by CVSS PR:L - typical attack paths therefore depend on the management interface being accessible from the attacker's network position (LAN, exposed WAN, or guest VLAN with reachability) and on weak, default, or otherwise obtained admin/operator credentials. No user interaction is required (UI:N), no special attack requirements apply (AT:N), and attack complexity is low (AC:L), so once the prerequisites are met exploitation is highly reliable; the principal limiting factors are the authentication requirement and the typically LAN-only exposure of SOHO/SMB AP management interfaces. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H with E:P scores 7.4 and indicates a network-reachable, low-complexity attack that nonetheless requires some level of authenticated access (PR:L) to the web management interface - meaning real-world risk is highest where default or weak admin credentials remain, or where the panel is exposed to untrusted networks. Publicly available exploit code (referenced via cdn2.v50to.cc) raises the practical likelihood of opportunistic targeting of internet-exposed devices, although no EPSS score or CISA KEV listing is included in the supplied data, so active in-the-wild exploitation is not confirmed. The scope/subsequent metrics are all None (SC:N/SI:N/SA:N), so impact is confined to the device itself, but on a wireless AP that still translates to a foothold on the LAN, traffic interception, and potential pivot - making this a meaningful priority for any Tenda W12 deployment, especially those without a vendor patch confirmed. |
| Exploit ScenarioDerived | An attacker who has obtained or guessed low-privilege web UI credentials (or who reaches an exposed management interface using default Tenda credentials) sends a crafted HTTP request to the time-setting endpoint of /bin/httpd with an oversized Time argument, overflowing the stack buffer in set_local_time_0. Using the publicly available proof-of-concept archive (set_local_time_0_overflow.zip), they overwrite the saved return address to execute attacker-controlled code as the httpd process, gaining persistent control over the access point and a pivot into the wireless network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – May 31, 2026
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote attackers to corrupt memory in the embedded HTTP daemon by supplying a crafted Time argument to the set_local_time_0 function in /bin/httpd. Publicly available exploit code exists, and the CVSS 4.0 base score of 7.4 reflects high impact to confidentiality, integrity, and availability with low-privilege network access. No CISA KEV listing or EPSS score is provided, so widespread opportunistic exploitation is not confirmed at this time.
Earlier versions of this analysis (2)
Stack-based buffer overflow in Tenda W12 3.0.0.7(4763) allows remote authenticated attackers to corrupt memory in the /bin/httpd binary by supplying a crafted Time argument to the set_local_time_0 function. Publicly available exploit code exists, and successful exploitation could enable arbitrary code execution on the affected wireless access point. The flaw is reachable over the network and impacts confidentiality, integrity, and availability of the device.
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows authenticated remote attackers to corrupt memory in the embedded httpd binary by manipulating the Time argument of the set_local_time_0 function, enabling code execution on the device. Publicly available exploit code exists per VulDB, but no public exploit identified as confirmed actively exploited in CISA KEV at time of analysis. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability with low attack complexity.
RemediationAI
No vendor-released patch identified at time of analysis; administrators should monitor https://www.tenda.com.cn/ for an updated W12 firmware image superseding 3.0.0.7(4763) and apply it as soon as it is published. Until a fix is available, restrict access to the device's HTTP management interface to a dedicated management VLAN or trusted admin workstations via ACLs, disable any WAN-side remote management option, and ensure the device is not reachable from the internet - recognizing the trade-off that remote administration workflows will be lost. Rotate the admin password to a strong unique value to raise the bar for the PR:L authentication requirement, and consider IPS signatures matching oversized Time parameters in POSTs to the time-setting endpoint of /bin/httpd; for high-risk deployments, replacing the device with a supported model is the most durable mitigation. Track the public exploit at http://cdn2.v50to.cc/set_local_time_0_overflow.zip only for detection-engineering purposes.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda W12 is an enterprise-grade wireless access point whose management interface is served by an embedded HTTP daemon (/bin/httpd) common to Tenda's MIPS/ARM-based SOHO and SMB networking products. CWE-121 (Stack-based Buffer Overflow) indicates that the set_local_time_0 handler copies the Time parameter into a fixed-size stack buffer without adequate bounds checking, so an oversized value overruns the saved return address and adjacent locals. Embedded Tenda httpd binaries historically lack modern mitigations such as stack canaries, NX, and ASLR on all segments, which makes stack-based overflows in these devices unusually amenable to control-flow hijacking and ROP-based code execution.
Know when W12 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Tenda W12 3.0.0.7(4763). The affected element is the function set_local_time_0 of the file /bin/httpd. Such manipulation of the argument Time leads to stack-based buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.
Executive ViewAI
Tenda W12 devices running firmware 3.0.0.7(4763) contain a remote memory corruption vulnerability (CVE-2026-10192) accessible via the HTTP daemon; publicly available exploit code exists, creating immediate risk. This affects organizations deploying Tenda W12 wireless access points, with potential for unauthorized network access and infrastructure compromise. No vendor patch is currently available, necessitating urgent interim protective measures.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network segmentation to restrict access to Tenda W12 devices from untrusted network segments; (2) Disable HTTP/HTTPS-based management interfaces where operationally feasible; (3) Deploy firewall rules to restrict administrative port access to authorized personnel and systems only; (4) Configure network-based intrusion prevention signatures to detect exploitation attempts targeting the set_local_time_0 function with crafted Time arguments; (5) Maintain continuous vendor communication for patch availability; (6) For critical access points, evaluate replacement options with vendors offering active security patching.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote authenticated attackers to corrupt memory
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows authenticated remote attackers to corrupt memory
Stack-based buffer overflow in Tenda W12 firmware 3.0.0.7(4763) allows remote attackers with low privileges to corrupt m
Denial of service in Tenda W12 firmware 3.0.0.7(4763) allows a low-privileged remote attacker to crash the web managemen
Exploit-DB