Tenda AC12 httpd Stack Buffer Overflow

Overview

CVE-2026-19821 is a stack-based buffer overflow vulnerability residing in the formSetRebootTimer function within the httpd web management binary of Tenda AC12 routers running firmware version 15.03.06.23_multi_TD01. The vulnerable endpoint is /goform/SetSysAutoRebbotCfg, reachable through the router’s HTTP-based administration interface without requiring physical access. An attacker who can reach the management interface — either on the LAN or, in misconfigured deployments, over the WAN — can supply a crafted rebootTime parameter value that overflows a fixed-size stack buffer, overwriting the saved return address and gaining control of the instruction pointer.

The flaw was identified and disclosed by security researchers who published a full proof-of-concept demonstrating the overflow condition. Because the exploit has been publicly released, the window between disclosure and active exploitation is effectively zero for unpatched devices. Tenda AC12 units are widely deployed in small-office and home-office environments, many of which expose the management interface to the WAN by default or through inadvertent misconfiguration, significantly widening the attack surface.

This class of vulnerability is endemic to consumer and SMB IoT firmware. Embedded HTTP daemons written in C frequently use fixed-size stack buffers to hold query-string parameters, and when input length is not validated before a copy operation, the results are predictable: stack corruption, potential code execution, and in the worst case, persistent backdoor implantation in a device that most users never update.

Technical Analysis

The root cause lives in how formSetRebootTimer handles the rebootTime POST parameter. The function retrieves the user-supplied string from the HTTP request and copies it into a local stack buffer of fixed, bounded size using an unsafe operation — effectively the C equivalent of an unchecked strcpy or sprintf. Because no length check precedes the copy, an attacker supplying a value longer than the buffer’s declared size overwrites adjacent stack frames.

A representative simplified reconstruction of the vulnerable pattern, consistent with typical Tenda httpd implementations, looks like this:

// Vulnerable pattern in formSetRebootTimer (reconstructed)
int formSetRebootTimer(HttpRequest *req) {
    char rebootTime[64];   // fixed-size stack buffer

    // nvram_safe_get or equivalent retrieves attacker-controlled input
    char *param = websGetVar(req, "rebootTime", "");

    // No length validation — direct copy into fixed buffer
    strcpy(rebootTime, param);  // <-- overflow occurs here

    // Further processing: parse rebootTime and schedule reboot
    scheduleReboot(rebootTime);
    return 0;
}

The websGetVar call returns a pointer directly into the parsed HTTP body. Because there is no strlen check against sizeof(rebootTime) before strcpy, an input string of 65 bytes or more begins overwriting the stack frame. On a MIPS32 architecture — the processor family used in most Tenda AC12 hardware — the saved return address ($ra) sits at a deterministic offset from local variables. With 64 bytes filling the buffer and a predictable additional offset, an attacker can overwrite $ra with a chosen address, redirecting execution after formSetRebootTimer returns.

The MIPS ABI complicates exploitation slightly compared to x86 (branch delay slots, cache coherency requirements for injected shellcode), but these are well-understood obstacles. On devices without ASLR or with only partial stack canary implementation — common in stripped-down embedded environments — exploitation is straightforward. Stack canaries, when absent or bypassable via an information-leak primitive, provide no mitigation. NX/DEP equivalents may redirect attackers toward return-oriented programming (ROP) chains, but the large and predictable code footprint of httpd provides abundant gadgets.

The endpoint /goform/SetSysAutoRebbotCfg requires authentication in the default firmware configuration, which is why the CVSS base score lands at 8.8 rather than a 9.x critical rating — the authentication requirement is reflected in the Attack Complexity and Privileges Required vectors. However, Tenda routers have historically shipped with weak default credentials, and credential-stuffing or adjacent-network attacks trivially satisfy the authentication prerequisite.

Impact

A successful exploit delivers arbitrary code execution in the security context of the httpd process, which on Tenda AC12 firmware runs as root. From this foothold an attacker can:

• Establish persistent access by modifying firmware boot scripts or injecting a backdoor binary into non-volatile storage.
• Intercept and manipulate network traffic for all clients behind the router — DNS hijacking, SSL stripping, or ARP poisoning at the gateway level.
• Pivot into the LAN to attack internal hosts that are otherwise not reachable from the internet.
• Enroll the device into a botnet — Mirai variants and their descendants actively scan for and exploit Tenda router vulnerabilities via exactly this attack surface.
• Exfiltrate credentials for connected services if stored in NVRAM or passed through the router’s DNS resolver.

The CVSS 8.8 score corresponds to vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The network-exploitable, low-complexity nature combined with high impact across all three security properties makes this a priority patch target for any organization with AC12 units in their environment.

How to Fix It

For end users and network administrators: Apply any firmware update released by Tenda for the AC12 addressing this vulnerability. Until a patch is available or applied:

1. Disable remote management — ensure the web management interface is bound only to the LAN interface and is not reachable from the WAN.
2. Enforce strong, non-default credentials on the admin interface.
3. Segment the management interface using firewall rules or VLAN isolation so that only trusted management hosts can reach it.

For Tenda and OEM firmware developers, the fix is straightforward — replace unsafe unbounded copy operations with length-limited equivalents and validate all input before use:

// Fixed pattern: bounded copy with explicit length validation
int formSetRebootTimer(HttpRequest *req) {
    char rebootTime[64];

    char *param = websGetVar(req, "rebootTime", "");

    // Validate length before any copy operation
    if (param == NULL || strlen(param) >= sizeof(rebootTime)) {
        websError(req, 400, "Invalid rebootTime parameter");
        return -1;
    }

    // Safe bounded copy
    strncpy(rebootTime, param, sizeof(rebootTime) - 1);
    rebootTime[sizeof(rebootTime) - 1] = '\0';  // guarantee NUL termination

    scheduleReboot(rebootTime);
    return 0;
}

Additional hardening measures that should accompany the code fix:

• Enable stack canaries (-fstack-protector-strong) in the firmware build system.
• Enable NX/XN on the stack and heap segments.
• Enable full RELRO and PIE for the httpd binary to complicate ROP-based exploitation.
• Implement a centralized input sanitization layer at the HTTP dispatch level so all goform handlers receive pre-validated, length-bounded parameter strings.

Our Take

This vulnerability follows a pattern we see repeatedly across consumer and SMB IoT firmware: a C-language HTTP daemon, a handler function that calls websGetVar or an equivalent, and a strcpy (or sprintf with a user-controlled format string) into a stack buffer. The fix is one line — a length check — and the exploit is a buffer of As. The fact that this class of bug continues to appear in shipping firmware in 2026 reflects a persistent gap in secure development practices at the firmware level.

For enterprises operating mixed environments that include IoT and edge devices, this is a reminder that the attack surface extends well beyond the application stack. A single compromised gateway device can negate significant investment in endpoint and cloud security controls. IoT devices must be subject to the same vulnerability management lifecycle as servers and workstations: inventory, patch tracking, network segmentation, and decommission when the vendor stops shipping security updates.

Detection with SAST

This vulnerability class maps to CWE-121: Stack-based Buffer Overflow, a child of CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer. In SAST analysis of embedded C/C++ firmware, Offensive360’s engine flags this pattern through taint-tracking rules that trace data flow from HTTP parameter retrieval functions (websGetVar, nvram_safe_get, cgiGetEnv, and equivalents) to sink functions that perform unbounded memory writes (strcpy, strcat, sprintf, gets, scanf with %s).

Key detection rules applied to this vulnerability class:

• Taint source identification: any function that reads from HTTP request parameters, environment variables, or NVRAM is tagged as a taint source.
• Unsafe sink matching: calls to strcpy, strcat, vsprintf, and sprintf where the destination buffer is a fixed-size stack allocation and the source is tainted are raised as HIGH severity findings.
• Buffer size inference: the engine computes or estimates the declared size of the destination buffer and compares it against the maximum possible length of the tainted input to distinguish certain overflows from potential ones.
• Mitigation bypass check: findings where the code path lacks an intervening strlen/strnlen check against the buffer size before the copy are promoted; findings where a correct length check exists are suppressed or downgraded.

Running Offensive360’s firmware analysis pipeline against the AC12 httpd binary — even without source code, through binary lifting to an intermediate representation — produces a flag on formSetRebootTimer at the strcpy call site with a full taint path from the rebootTime parameter to the stack buffer, exactly as the disclosed PoC demonstrates.

References

• https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/4.md
• https://vuldb.com/cve/CVE-2026-19821
• https://vuldb.com/submit/868922
• https://vuldb.com/vuln/389954
• https://vuldb.com/vuln/389954/cti
• https://www.tenda.com.cn/