CVE-2026-10190: Tenda W12 Web Management httpd cgiSysWebTimeoutSet denial of service

Synopsis

A denial-of-service vulnerability exists in the web management interface (httpd) of the Tenda W12 router, firmware version 3.0.0.7(4763). The flaw is in the cgiSysWebTimeoutSet function, where an attacker can manipulate the web_over_time argument to crash or hang the httpd process. Exploitation is possible remotely with a low-privilege account, and a proof-of-concept has been made public. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's web management interface over the network; the CVSS vector specifies AV:N, meaning no local or physical access is needed.

• AuthenticationRequired

  The CVSS vector specifies PR:L, meaning a low-privilege account on the web management interface is sufficient to trigger the vulnerability.

• Victim interactionNot required

  The CVSS vector specifies UI:N; the attacker can exploit the flaw without any action from another user or administrator.

• Attack complexityDetail

  The CVSS vector specifies AC:L and AT:N, meaning the exploit is reliable, requires no special timing, and imposes no environmental pre-conditions.

Blast Radius

• Crashes or hangs the httpd process on the Tenda W12, taking down the web management interface for the duration of the outage.
• Administrators lose the ability to manage or reconfigure the device through the web UI until the service recovers or the device is rebooted.
• Repeated exploitation can sustain a persistent denial-of-service condition against the management plane of the affected router.