This vulnerability exists in Tenda W12 firmware version 3.0.0.7(4763) within the cgiSysTimeInfoSet function of the /bin/httpd executable. By manipulating the 'sec' parameter, an attacker can cause a stack-based buffer overflow remotely. The CVSS 4.0 base score is 8.7, reflecting high impact due to remote network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by the vendor as of the vulnerability disclosure date.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected device, potentially leading to full compromise of the Tenda W12 router. This could impact device confidentiality, integrity, and availability. The vulnerability is exploitable remotely without user interaction and requires low privileges, increasing the risk of exploitation. However, there is no confirmed evidence of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting remote access to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.