Description
A vulnerability was determined in Tenda W12 3.0.0.7(4763). Impacted is the function cgiWifiMacFilterSet of the file /bin/httpd. This manipulation of the argument wifiMacFilterSet.macList.mac causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-05-31
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack-based buffer overflow exists in the cgiWifiMacFilterSet function of the Tenda W12 router firmware, specifically crafted by supplying a malformed wifiMacFilterSet.mac argument. The flaw can allow remote attackers to corrupt the stack, potentially executing arbitrary code on the device with privileges of the httpd process. Based on the disclosed attack method, the vulnerability is exploitable over the network by sending crafted HTTP requests to the router's web interface, confirming a remote exploitation vector.

Affected Systems

Tenda W12 routers running firmware version 3.0.0.7 (build 4763) are affected. No other models or firmware releases are known to be impacted.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, combining high impact on confidentiality, integrity, and availability with a remote attack vector. EPSS data is not available, so the exact likelihood of exploitation is uncertain, but the vulnerability is publicly disclosed and a proof‑of‑concept has been released. It is not currently listed in the CISA KEV catalog. Given the remote nature of the exploit and the lack of mitigation, the risk to affected devices warrants urgent action.

Generated by OpenCVE AI on May 31, 2026 at 17:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update released by Tenda that addresses the buffer overflow flaw.
  • If a vendor update is not yet available, restrict access to the router’s web management interface by configuring firewall rules or disabling the HTTP interface entirely.
  • Disable or severely limit the MAC filter management feature to reduce the attack surface for the vulnerable endpoint.

Generated by OpenCVE AI on May 31, 2026 at 17:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 01 Jun 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 31 May 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Tenda w12
Vendors & Products Tenda w12

Sun, 31 May 2026 16:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Tenda W12 3.0.0.7(4763). Impacted is the function cgiWifiMacFilterSet of the file /bin/httpd. This manipulation of the argument wifiMacFilterSet.macList.mac causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Title Tenda W12 httpd cgiWifiMacFilterSet stack-based overflow
First Time appeared Tenda
Tenda w12 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:w12_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda w12 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda W12 W12 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-01T15:24:11.577Z

Reserved: 2026-05-30T16:45:16.184Z

Link: CVE-2026-10191

cve-icon Vulnrichment

Updated: 2026-06-01T15:16:44.975Z

cve-icon NVD

Status : Deferred

Published: 2026-05-31T16:16:41.537

Modified: 2026-06-01T15:15:37.293

Link: CVE-2026-10191

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-31T17:30:08Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow