This vulnerability involves a stack-based buffer overflow in the set_local_time_0 function of the /bin/httpd binary on Tenda W12 devices running firmware version 3.0.0.7(4763). Remote attackers can exploit this by sending crafted input to the Time argument, causing memory corruption. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The exploit code is publicly available, increasing the risk of exploitation. No official patch or mitigation has been disclosed by Tenda.

Successful exploitation of this vulnerability allows remote attackers to cause a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service on affected Tenda W12 devices. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. The presence of a public exploit increases the risk, although no active exploitation has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected device's management interface to trusted sources only. Monitor vendor channels for updates and apply patches promptly once available.