CVE-2026-10192: Tenda W12 httpd set_local_time_0 stack-based overflow

Synopsis

A stack-based buffer overflow exists in the Tenda W12 router (firmware version 3.0.0.7(4763)) inside the set_local_time_0 function of the httpd binary. The vulnerability is reachable over the network by any authenticated user with a low-privilege account, requiring no victim interaction, by supplying a crafted value to the Time argument. Successful exploitation gives an attacker full read and write access to memory and can crash the affected service, enabling likely remote code execution on the device. No upstream fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's httpd service over the network; no local or physical access is required.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must be authenticated to issue requests to the set_local_time_0 endpoint.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends a crafted request directly to the service without any user involvement.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or environmental factors to trigger the overflow.

Blast Radius

• The attacker achieves high-confidence read access to process memory, exposing credentials, session tokens, or configuration data stored in the httpd process.
• The attacker achieves high-confidence write access to process memory, allowing arbitrary modification of runtime state or persistent configuration on the device.
• The httpd service can be crashed, taking down remote management and any dependent functionality on the router.
• Combined memory read and write primitives from a stack overflow in a network-facing binary make remote code execution on the device a realistic outcome.