CVE-2026-10188: Tenda W12 httpd cgistaKickOff stack-based overflow

Synopsis

A stack-based buffer overflow exists in the cgistaKickOff function of the httpd binary on Tenda W12 firmware version 3.0.0.7(4763). An attacker with low-privilege network access can send a crafted staMac argument to trigger the overflow, requiring no victim interaction. Successful exploitation gives the attacker full read and write access to memory and can crash or take control of the affected service, enabling remote code execution. No fix version has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable httpd service is exposed over the network, and the attacker must be able to reach it remotely to deliver the malicious staMac argument.

• AuthenticationRequired

  The CVSS vector specifies PR:L, meaning any low-privilege account on the device is sufficient to trigger the vulnerable code path; no admin access is needed.

• Victim interactionNot required

  The attack is fully attacker-driven and requires no action from a logged-in user or administrator on the target device.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free, with no race conditions or special environmental state required to trigger the overflow.

Blast Radius

• Attacker reads memory contents of the httpd process, which may include session tokens, credentials, or configuration data stored in the running process.
• Attacker writes arbitrary data into the stack, overwriting return addresses and enabling execution of attacker-controlled code within the httpd process context.
• The affected httpd service crashes if the overflow is used for disruption rather than code execution, taking down web-based device management until the service restarts.
• Impact is contained to the device itself (SC:N, SI:N, SA:N), meaning lateral scope to other network systems requires additional attacker steps beyond this vulnerability alone.