CVE-2026-10188 is a stack-based buffer overflow vulnerability affecting Tenda W12 firmware version 3.0.0.7(4763). The issue resides in the cgistaKickOff function of the /bin/httpd binary, where improper handling of the staMac argument allows an attacker to overflow the stack buffer remotely. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7, indicating it is exploitable over the network without user interaction and requires low attack complexity. Exploit code has been published, increasing the risk of exploitation. No official patch or vendor advisory detailing remediation is currently available.

Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code or cause a denial of service on affected Tenda W12 devices running firmware 3.0.0.7(4763). The vulnerability is remotely exploitable without user interaction and has a high impact on confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting remote access to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.