The vulnerability is a stack-based buffer overflow in the form_fast_setting_wifi_set function of the Wi‑Fi Configuration Endpoint on Tenda CX12L routers. By manipulating the ssid argument, an attacker can overflow the buffer. Based on the description, it is inferred that this overflow may lead to arbitrary code execution, denial of service, and compromise of confidentiality and integrity of the device.

Affected are Tenda CX12L devices running firmware version 16.03.53.12. The flaw resides in the /goform/fast_setting_wifi_set endpoint and is present in the specified firmware build.

The CVSS score of 8.7 indicates high severity, and the attack vector is remote, meaning the attacker need only reach the router over the network to exploit it. EPSS is not available, so the current probability of exploitation is unknown, but the vulnerability has been publicly disclosed and could be used by adversaries. Tenda has not listed it in the CISA KEV catalog yet. The lack of an official patch means the risk remains significant until remediation is applied.