CVE-2026-10191: Tenda W12 httpd cgiWifiMacFilterSet stack-based overflow

Synopsis

A stack-based buffer overflow affects the Tenda W12 router firmware (version 3.0.0.7(4763)) in the cgiWifiMacFilterSet function of the httpd binary. The vulnerability is reachable over the network with a low-privilege account and requires no user interaction; an attacker supplies an oversized value in the wifiMacFilterSet.macList.mac argument to overflow a stack buffer. Successful exploitation gives the attacker full read, write, and execution control over the affected device. No fix version has been published; HarborGuard tracks the upstream advisory and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's HTTP service over the network; no local access or physical proximity is needed.

• AuthenticationRequired

  A low-privilege account is sufficient; any valid login credential on the device satisfies this requirement.

• Victim interactionNot required

  No action from a logged-in user or any other person is needed to trigger the overflow.

• Attack complexityDetail

  Exploit reliability is high: no race conditions, memory-layout guessing, or special environmental factors are required.

Blast Radius

• The attacker achieves arbitrary code execution on the router, gaining full control over the device.
• All data passing through or stored on the device, including Wi-Fi credentials and connected-client records, is readable by the attacker.
• The attacker can modify router configuration, including MAC filter rules, DNS settings, and routing tables.
• The httpd process and broader device operation can be crashed or held in an attacker-controlled state, disrupting network service for all connected clients.