This vulnerability affects Tenda W12 version 3.0.0.7(4763) and involves a stack-based buffer overflow triggered by manipulating the 'sec' argument in the cgiSysTimeInfoSet function within the /bin/httpd binary. The flaw allows remote attackers to cause memory corruption, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been published by the vendor as of the data provided.

Successful exploitation can lead to remote code execution or denial of service on affected Tenda W12 devices, compromising device confidentiality, integrity, and availability. The vulnerability is exploitable remotely without authentication or user interaction, increasing the risk of widespread impact. However, there is no current evidence of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider disabling remote management features if possible or isolating the device from untrusted networks to reduce exposure.