CVE-2026-10190 Overview
CVE-2026-10190 is a denial of service vulnerability in the Tenda W12 wireless access point running firmware version 3.0.0.7(4763). The flaw resides in the cgiSysWebTimeoutSet function within the /bin/httpd binary that powers the device's Web Management Interface. Attackers can trigger the condition by manipulating the web_over_time argument, causing the HTTP daemon to fail and rendering the management interface unavailable. The issue is exploitable remotely and requires only low-level authenticated access. A public exploit archive has been released, increasing the risk of opportunistic abuse against exposed devices.
Critical Impact
Remote authenticated attackers can crash the Tenda W12 web management daemon by sending a crafted web_over_time parameter, disrupting device administration.
Affected Products
- Tenda W12 wireless access point
- Firmware version 3.0.0.7(4763)
- Web Management Interface (/bin/httpd)
Discovery Timeline
- 2026-05-31 - CVE-2026-10190 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-10190
Vulnerability Analysis
The vulnerability is classified under [CWE-404] Improper Resource Shutdown or Release. The cgiSysWebTimeoutSet handler inside /bin/httpd processes the web_over_time HTTP parameter without adequate validation or resource cleanup. When an attacker supplies a malformed or unexpected value, the daemon enters an error state that terminates the management service.
Because the affected component is the device's primary administration channel, the outage prevents legitimate operators from reconfiguring the access point, applying updates, or responding to other incidents. The reachable attack surface includes any network segment where the Web Management Interface is exposed.
Root Cause
The root cause is improper handling of the web_over_time argument during timeout configuration processing. The function does not safely release or reset resources when the input violates expected bounds, resulting in a service-terminating condition consistent with CWE-404.
Attack Vector
Exploitation occurs over the network against the HTTP management interface. The attacker requires low-privilege credentials but no user interaction. A public proof-of-concept is distributed as a ZIP archive containing a crafted request targeting the vulnerable CGI endpoint. Sending the malformed web_over_time value to cgiSysWebTimeoutSet is sufficient to disable the web daemon.
The vulnerability mechanism is documented in the VulDB CVE-2026-10190 entry and the associated VulDB Vulnerability #367471 record. The public exploit is hosted as the DOS Exploit ZIP Archive.
Detection Methods for CVE-2026-10190
Indicators of Compromise
- Unexpected restarts or crashes of the /bin/httpd process on Tenda W12 devices.
- HTTP POST requests targeting cgiSysWebTimeoutSet containing unusual or oversized web_over_time values.
- Loss of access to the Web Management Interface following authenticated sessions from unfamiliar source addresses.
Detection Strategies
- Inspect web server and HTTP proxy logs for requests referencing cgiSysWebTimeoutSet with anomalous parameter content.
- Correlate authentication events on the device with subsequent management interface outages to identify abuse patterns.
- Alert on repeated 5xx responses or connection resets from the access point's administrative HTTP port.
Monitoring Recommendations
- Continuously monitor uptime and reachability of the Tenda W12 management interface using network synthetic checks.
- Capture and retain HTTP request bodies destined for the device's CGI endpoints to support forensic review.
- Generate alerts on management plane traffic originating from non-administrative VLANs or untrusted source networks.
How to Mitigate CVE-2026-10190
Immediate Actions Required
- Restrict access to the Tenda W12 Web Management Interface to a dedicated management VLAN or trusted administrative hosts only.
- Rotate management credentials and remove any unused low-privilege accounts that could be leveraged to reach cgiSysWebTimeoutSet.
- Block external reachability of the device's HTTP administration port at the perimeter firewall.
Patch Information
No vendor patch has been published in the available references at the time of CVE assignment. Operators should monitor the Tenda Official Website for firmware updates addressing the cgiSysWebTimeoutSet handler. Until a fix is released, compensating network controls are required to reduce exposure.
Workarounds
- Disable remote administration features on the W12 and require on-device or VPN-based access to the management interface.
- Place the device behind a reverse proxy or WAF that filters requests to cgiSysWebTimeoutSet and validates the web_over_time parameter.
- Implement rate limiting on management interface endpoints to slow automated exploitation attempts.
# Example iptables rule restricting Web Management Interface access
# Replace 192.0.2.0/24 with your administrative subnet and <W12_IP> with the device address
iptables -A FORWARD -p tcp -d <W12_IP> --dport 80 -s 192.0.2.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <W12_IP> --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
