Description
A weakness has been identified in Tenda i12 1.0.0.6(2204). The affected element is the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet. This manipulation of the argument index causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-03-12
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A stack-based buffer overflow flaw was discovered in the formWifiMacFilterGet function of Tenda i12 firmware 1.0.0.6(2204). The weakness is triggered by manipulating the argument index, allowing an attacker to overflow the stack when the /goform/WifiMacFilterGet endpoint is accessed; the flaw is exploitable remotely and public proof-of-concept exploits have been released.

Affected Systems

The vulnerability affects Tenda i12 routers running firmware version 1.0.0.6(2204). No other versions are listed in the CNA data, so only this build is confirmed vulnerable.

Risk and Exploitability

The CVSS v3 base score is 8.7, indicating high severity, and the EPSS score is reported as less than 1%, suggesting a low but non-zero probability of exploitation today. The flaw is not yet in the CISA KEV catalog. An attacker can trigger the overflow via the web interface from a remote host, potentially gaining arbitrary code execution on the device.

Generated by OpenCVE AI on March 18, 2026 at 15:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Tenda i12 firmware to the latest version that addresses the stack-based buffer overflow.
  • If an updated firmware is not immediately available, disable or block remote access to the device’s web management interface via firewall rules or by disabling the service entirely.
  • Monitor the device’s system logs for abnormal requests to /goform/WifiMacFilterGet and investigate any anomalies.
  • After applying an update or workaround, verify the firmware version to confirm the vulnerability has been remedied.

Generated by OpenCVE AI on March 18, 2026 at 15:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
CPEs cpe:2.3:h:tenda:i12:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:i12_firmware:1.0.0.6\(2204\):*:*:*:*:*:*:*

Fri, 13 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Tenda i12
Vendors & Products Tenda i12

Thu, 12 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 12 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Tenda i12 1.0.0.6(2204). The affected element is the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet. This manipulation of the argument index causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Title Tenda i12 WifiMacFilterGet formWifiMacFilterGet stack-based overflow
First Time appeared Tenda
Tenda i12 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:i12_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda i12 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda I12 I12 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-12T15:34:00.209Z

Reserved: 2026-03-12T08:30:09.168Z

Link: CVE-2026-4042

cve-icon Vulnrichment

Updated: 2026-03-12T15:33:54.625Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-12T15:16:34.180

Modified: 2026-04-02T20:04:42.220

Link: CVE-2026-4042

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-20T15:49:45Z

Weaknesses