CVE-2026-10189: Tenda w12

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A vulnerability has been found in Tenda W12 3.0.0.7(4763). This vulnerability affects the function cgiSysTimeInfoSet of the file /bin/httpd. The manipulation of the argument sec leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products

• Tenda w12: version 3.0.0.7(4763) only

Published 2026-05-31. Last modified 2026-07-22.