CVE-2026-10192: Tenda W12 Stack Overflow Remote Code Execution

Technical summary

The vulnerability resides in the set_local_time_0 function within the /bin/httpd binary. The Time parameter fails to implement proper bounds checking before copying user-supplied input to a fixed-size stack buffer. This classic stack-based buffer overflow (CWE-119, CWE-121) can be exploited by an authenticated user to overwrite the stack frame, hijack control flow, and execute arbitrary commands with the privileges of the httpd process. The flaw does not require user interaction and can be triggered over the network.

Business impact

Compromise of a Tenda W12 router provides an attacker with a foothold in the network perimeter. An adversary with valid credentials—obtained through phishing, default credentials, or prior compromise—can escalate to remote code execution, giving them the ability to intercept traffic, pivot to internal systems, deploy malware, or establish persistent access. For organizations relying on this device for branch office connectivity or guest network isolation, such compromise directly undermines network segmentation and defense-in-depth strategies.

Affected systems

Tenda W12 firmware version 3.0.0.7(4763) is confirmed vulnerable. Tenda W12 devices running this or earlier firmware versions are at risk. Organizations should verify their deployed Tenda W12 firmware revision immediately. Consult Tenda's advisories to determine whether other Tenda product lines or firmware branches are similarly affected.

Exploitability

This vulnerability requires authentication to trigger—an attacker must either have valid login credentials or bypass the authentication mechanism separately. The CVSS vector reflects this requirement (PR:L). However, the public availability of exploit code significantly lowers the barrier to weaponization. Organizations with weak credential hygiene, exposed management interfaces, or default credentials remain at elevated risk. The attack surface includes any network path that can reach the device's web interface.

Remediation

Firmware update is the definitive remediation. Identify the latest stable firmware release from Tenda for the W12 model and apply it to all affected devices. If no patched firmware is immediately available, implement network controls: restrict access to the device's web management interface to trusted administrative IPs, enforce strong authentication policies, and monitor for exploitation attempts. Consider replacing the device with an alternative vendor platform if Tenda does not provide timely patches.

Patch guidance

Check Tenda's official support website for W12 firmware releases newer than 3.0.0.7(4763). Download the latest firmware directly from Tenda, verify the checksum or signature if provided, and schedule a maintenance window to apply the update. Most Tenda devices can be updated via the web interface under System Tools or similar. Document pre- and post-update configurations, and test connectivity after the upgrade. If Tenda has not released a patched firmware version, contact their support channel for guidance and an expected remediation timeline.

Detection guidance

Monitor web server logs on affected Tenda W12 devices for POST requests to the set_local_time_0 endpoint or similar time-configuration URIs. Look for payloads with unusually long Time parameter values, null bytes, or characters inconsistent with standard timestamp formats. Network-based detection can flag connections to the Tenda device's management interface from unexpected sources. Intrusion detection systems may have signatures for stack overflow exploitation patterns; consult your IDS vendor for updates. Behavioral indicators include sudden device resets, unexpected process execution, or failed httpd process logs.

Why prioritize this

A CVSS 8.8 HIGH-severity vulnerability with authenticated remote code execution, combined with publicly available exploit code, demands immediate attention. While authentication is required, the prevalence of weak router credentials and the critical role routers play in network access control make this a top-tier priority for any organization deploying Tenda W12 devices.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high impact (confidentiality, integrity, and availability all compromised via code execution), network-based attack surface, and low attack complexity. The PR:L requirement (authenticated access) prevents a 9.8 or higher score. However, the existence of public exploit code and the credential-reuse problem in many organizations elevate real-world risk above the CVSS score alone. Rate this as HIGH priority and treat it as critically urgent for any device exposed on a management network or accessible to untrusted users.

Frequently asked questions