PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10189 Tenda CVE debrief

A stack-based buffer overflow vulnerability exists in the Tenda W12 router firmware version 3.0.0.7(4763). The vulnerability is located in the `cgiSysTimeInfoSet` function within the `/bin/httpd` binary. Remote attackers can trigger the overflow by manipulating the `sec` parameter. The exploit has been publicly disclosed, increasing the likelihood of active exploitation. The vendor attribution to Tenda is supported by a reference to the official Tenda website in the CNA-submitted references, though the vendor field carries low confidence and requires review.

Vendor
Tenda
Product
W12
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-31
Original CVE updated
2026-07-22
Advisory published
2026-05-31
Advisory updated
2026-07-22

Who should care

Organizations deploying Tenda W12 routers for wireless access infrastructure; security teams managing SOHO or remote office networks; incident response teams tracking public router exploits.

Technical summary

The `cgiSysTimeInfoSet` function in `/bin/httpd` on Tenda W12 firmware 3.0.0.7(4763) fails to properly validate the length of the `sec` argument, resulting in a stack-based buffer overflow. The vulnerability is remotely exploitable without user interaction and has a public exploit available. CVSS 4.0 score of 7.4 (HIGH) reflects network attack vector, low attack complexity, and high impacts to confidentiality, integrity, and availability.

Defensive priority

HIGH

Recommended defensive actions

  • Restrict network access to Tenda W12 administrative interfaces to trusted management networks only
  • Monitor for unauthorized access attempts targeting `/bin/httpd` endpoints, particularly `cgiSysTimeInfoSet`
  • Apply firmware updates from Tenda when available; verify patch version exceeds 3.0.0.7(4763)
  • Consider network segmentation to isolate affected devices from critical infrastructure
  • Review logs for anomalous `sec` parameter values in HTTP requests to device management interfaces

Evidence notes

CVE published 2026-05-31. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P. Weaknesses: CWE-119, CWE-121. Source references include a ZIP file hosted on v50to.cc domain and multiple VulDB entries. Vendor evidence derived from reference_domain_candidate 'V50to' and official Tenda website reference.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10189 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10189

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10189 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10189

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.