Vulnerability · Published May 31, 2026 · Assigned by VulDB
CVE-2026-10188Tenda W12 httpd cgistaKickOff stack-based overflow
High 8.8
In plain English
A high-severity stack buffer overflow in W12 from Tenda. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 58.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw has been found in Tenda W12 3.0.0.7(4763). This affects the function cgistaKickOff of the file /bin/httpd. Executing a manipulation of the argument staMac can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.
Affected products (as reported)
Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-367469 | Tenda W12 httpd cgistaKickOff stack-based overflow vdb-entry, technical-description
- VDB-367469 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-10188 | CVE Analysis and Report third-party-advisory
- Submit #820018 | Tenda W12 V3.0.0.7(4763) Stack-based Buffer Overflow third-party-advisory
- http://cdn2.v50to.cc/Tenda%20W12%20cgistaKickOff%20overflow.zip exploit
- https://www.tenda.com.cn/ product