Description
A vulnerability was identified in Tenda W12 3.0.0.7(4763). The affected element is the function set_local_time_0 of the file /bin/httpd. Such manipulation of the argument Time leads to stack-based buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.
Published: 2026-05-31
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack-based buffer overflow was discovered in the set_local_time_0 function of the Tenda W12 firmware. The overflow occurs when the Time argument supplied to the /bin/httpd component is manipulated, allowing an attacker to corrupt memory on the device stack. Successful exploitation can lead to arbitrary code execution from a remote host, as the vulnerability resides in a web‑based service that can be accessed over the network.

Affected Systems

The vulnerability affects Tenda W12 devices running firmware version 3.0.0.7(4763). No other vendor or product versions are presently listed as impacted.

Risk and Exploitability

The CVSS score of 8.7 marks this flaw as high severity, and the exploit is already publicly available. EPSS information is not available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, taking advantage of the HTTP interface to trigger the overflow.

Generated by OpenCVE AI on May 31, 2026 at 17:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update for the Tenda W12 that addresses the buffer overflow in /bin/httpd.
  • If an update is not yet available, restrict or disable remote access to the device’s administration interface or block traffic to the affected endpoint using network controls.
  • Continuously monitor device logs and network traffic for unusual patterns or attempts to manipulate the set_local_time_0 parameter, and alert administrators if suspicious activity is detected.

Generated by OpenCVE AI on May 31, 2026 at 17:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 01 Jun 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 31 May 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Tenda w12
Vendors & Products Tenda w12

Sun, 31 May 2026 16:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Tenda W12 3.0.0.7(4763). The affected element is the function set_local_time_0 of the file /bin/httpd. Such manipulation of the argument Time leads to stack-based buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.
Title Tenda W12 httpd set_local_time_0 stack-based overflow
First Time appeared Tenda
Tenda w12 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:w12_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda w12 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda W12 W12 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-01T12:29:51.172Z

Reserved: 2026-05-30T16:45:18.912Z

Link: CVE-2026-10192

cve-icon Vulnrichment

Updated: 2026-06-01T12:29:44.659Z

cve-icon NVD

Status : Deferred

Published: 2026-05-31T17:16:30.753

Modified: 2026-06-01T15:15:37.293

Link: CVE-2026-10192

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-31T17:30:08Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow