CVE-2026-10191: Tenda W12 Stack Buffer Overflow in Wi-Fi MAC Filter – Patch & Detection Guide

Technical summary

The vulnerability resides in the cgiWifiMacFilterSet function of /bin/httpd in Tenda W12 3.0.0.7(4763). The wifiMacFilterSet.macList.mac parameter is processed without proper bounds checking, enabling a stack-based buffer overflow (CWE-119, CWE-121). An authenticated attacker can overflow the stack buffer by supplying an oversized MAC address string, corrupting the call stack and potentially achieving arbitrary code execution within the httpd process context. The flaw is remotely exploitable with low attack complexity and does not require user interaction.

Business impact

Successful exploitation allows an authenticated attacker to execute arbitrary code on the affected router, potentially granting full device compromise. An attacker could intercept network traffic, modify firewall rules, pivot to internal networks, or cause denial of service. For organizations deploying Tenda W12 devices as network edge equipment or branch office gateways, this vulnerability represents a significant risk to network perimeter integrity and data confidentiality.

Affected systems

Tenda W12 firmware version 3.0.0.7(4763) is confirmed vulnerable. Organizations should verify whether other Tenda W12 firmware versions or related Tenda product lines share the same code path; this determination requires direct consultation with Tenda's security advisories. The vulnerability requires network access and valid administrative or user credentials to trigger.

Exploitability

This vulnerability has a CVSS 3.1 score of 8.8 (HIGH) with network reachability, low attack complexity, and authentication required. While the attack requires valid login credentials, the public disclosure of exploit code lowers the barrier to weaponization. Threat actors with network access and stolen or compromised credentials can quickly move from discovery to exploitation. The low complexity means no special environmental configuration is needed to trigger the flaw.

Remediation

Verify and deploy the latest firmware release from Tenda for the W12 product line to remediate this buffer overflow. Until patched firmware is available or can be deployed, restrict administrative access to the W12 web interface through network segmentation, firewall rules, or VPN gating. Review access logs for suspicious MAC filter configuration attempts. Consider temporarily disabling the MAC filter feature if it is not operationally critical.

Patch guidance

Contact Tenda support or visit their firmware download portal to obtain and verify the latest W12 firmware build. Apply patches during a maintenance window, backing up device configuration beforehand. Test patches in a non-production environment first if possible. Verify that the installed version differs from 3.0.0.7(4763) and confirm via Tenda's security advisories that the buffer overflow in cgiWifiMacFilterSet has been addressed. Document the patch date and version for compliance and incident response records.

Detection guidance

Monitor router logs and web server access logs for POST or GET requests to /bin/httpd containing the wifiMacFilterSet parameter with abnormally long or malformed MAC address values. Use intrusion detection signatures targeting buffer overflow patterns in MAC filter input. Correlate failed authentication attempts or credential reuse with subsequent successful logins followed by Wi-Fi configuration changes. Check for unexpected process behavior or spawned shells from the httpd process. Implement network telemetry to detect lateral movement or unusual traffic patterns following a successful login to the device.

Why prioritize this

This vulnerability merits immediate priority due to the combination of remote network accessibility, public exploit availability, high CVSS score (8.8), and the potential for complete device compromise. Although authentication is required, the prevalence of weak or reused credentials on IoT devices and the criticality of router security to network defense justify urgent patching. Organizations should treat this as a high-priority remediaton target within 30 days.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects network-based attack feasibility, low complexity, required authentication, and impacts to confidentiality, integrity, and availability. The score is tempered by the authentication requirement; however, this is offset by the public exploit disclosure and the attractive target profile of routers for lateral network movement. In environments where router credentials are not strictly controlled or where default credentials remain in use, the real-world risk may be higher than the base score suggests.

Frequently asked questions