CVE-2026-10188: Tenda W12 Stack Overflow Remote Code Execution

Technical summary

CVE-2026-10188 is a stack-based buffer overflow (CWE-119, CWE-121) in Tenda W12 firmware. The vulnerability resides in the cgistaKickOff function of /bin/httpd, where insufficient bounds checking on the staMac argument allows an authenticated attacker to write beyond allocated buffer boundaries. The attack vector is network-based, requires valid credentials, and does not require user interaction. The CVSS v3.1 score of 8.8 (HIGH) reflects the combination of remote exploitability and high impact on confidentiality, integrity, and availability.

Business impact

Exploitation could allow an authenticated attacker to compromise the integrity and confidentiality of network traffic managed by the Tenda W12 router, as well as disrupt service availability. In enterprise or critical network environments where this device serves as a gateway or access point, such a compromise could enable lateral movement, data exfiltration, or persistent presence. The public availability of exploit code substantially increases the likelihood of opportunistic attacks.

Affected systems

Tenda W12 firmware version 3.0.0.7(4763) is confirmed vulnerable. Organizations using this wireless router model in network infrastructure should verify their current firmware versions. Note: Tenda has not been confirmed to have released patched firmware; verify the vendor's official advisory for remediation guidance and any firmware updates addressing this issue.

Exploitability

This vulnerability requires authentication, which moderates but does not eliminate the threat in networks where default or weak credentials are common. The availability of public exploit code, combined with the straightforward attack surface (HTTP daemon parameter manipulation), means skilled attackers can weaponize this quickly. Network-based exploitability removes the need for physical access or user-triggered actions, making it attractive for targeted intrusions.

Remediation

Immediate action: consult Tenda's official security advisories and support channels for patched firmware versions. If patches are unavailable, implement network-level mitigations: restrict administrative access to the Tenda W12 via firewall rules, change default credentials to strong unique passwords, and consider network segmentation to limit exposure of management interfaces. Monitor for suspicious HTTP requests to /bin/httpd targeting the cgistaKickOff function.

Patch guidance

Verify the latest firmware available from Tenda's official support portal or security advisories. Apply any released firmware updates immediately upon availability. Test patches in a non-production environment first. If patches are not yet available, prioritize compensating controls (access restrictions, credential hardening) until an official fix is released. Track Tenda's CVE response page and firmware release notes for updates.

Detection guidance

Monitor HTTP access logs on affected Tenda W12 devices for POST/GET requests to cgistaKickOff or /bin/httpd with unusually long or malformed staMac parameter values. Set alerts for authentication events followed by unusual process execution or memory access patterns. Use network-based intrusion detection signatures targeting stack overflow patterns in HTTP requests to Tenda devices. Endpoint detection and response (EDR) tools on connected systems may also flag exploitation attempts.

Why prioritize this

HIGH priority due to: (1) high CVSS score (8.8) reflecting complete compromise potential, (2) public exploit code availability dramatically lowering the barrier to attack, (3) remote exploitability over HTTP, and (4) the critical role Tenda W12 routers often play in network access. Organizations should patch or implement compensating controls within 30 days. Authenticated requirement is a mitigating factor but not sufficient given default credential risks.

Risk score, explained

The CVSS v3.1 score of 8.8 reflects a network-adjacent attack vector, low attack complexity, and requirement for low-level privileges (authentication). The impact is high across all three dimensions: confidentiality (full information disclosure), integrity (unauthorized modification), and availability (service interruption). The public disclosure and availability of exploit code further justify treating this as a near-critical risk requiring rapid response.

Frequently asked questions