CVE-2026-10188 is a stack-based buffer overflow vulnerability affecting Tenda W12 firmware version 3.0.0.7(4763). The flaw resides in the cgistaKickOff function of the /bin/httpd binary, where improper handling of the staMac argument allows an attacker to overflow the stack. This vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. The CVSS 4.0 vector indicates high impact on confidentiality, integrity, and availability. No official remediation or patch information is currently available.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected device, potentially leading to full compromise of the Tenda W12 router. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. However, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying network-level protections such as restricting access to the device's management interface from untrusted networks may reduce exposure.