CVE-2026-10189: Tenda W12 httpd cgiSysTimeInfoSet stack-based overflow

Synopsis

A stack-based buffer overflow exists in the cgiSysTimeInfoSet function of the httpd binary on Tenda W12 firmware version 3.0.0.7(4763). The vulnerability is reachable over the network by a low-privilege authenticated user who can manipulate the 'sec' argument, causing the stack to be overwritten. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected device, up to and including remote code execution. No fix version has been published; HarborGuard tracks this advisory and will make a patched rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable httpd service is exposed over the network, so an attacker must be able to reach the device's HTTP interface across the network to trigger the overflow.

• AuthenticationRequired

  The attack requires a low-privilege account on the device; any valid user credential is sufficient, but unauthenticated access alone does not trigger the vulnerable code path.

• Victim interactionNot required

  No action from another user or administrator on the device is needed; the attacker can complete the exploit entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads all data accessible to the httpd process, including stored credentials and configuration secrets on the device.
• Modifies persisted device configuration and system state, allowing the attacker to alter routing rules, DNS settings, or firmware behavior.
• Crashes or restarts the httpd service, disrupting network management and web-based administration for all users of the device.
• Achieves arbitrary code execution in the context of the httpd process, enabling further lateral movement into the network the device serves.