A stack-based buffer overflow exists in the setSchedWifi function of the Wi‑Fi Schedule Configuration Endpoint /goform/openSchedWifi on Tenda CX12L firmware 16.03.53.12. Manipulating the parameters schedStartTime or schedEndTime allows an attacker to overflow a stack buffer, which can lead to arbitrary code execution when the vulnerable module is invoked. This flaw directly compromises the confidentiality, integrity, and availability of the device by giving an attacker the ability to run malicious code remotely.

The vulnerable product is the Tenda CX12L router running firmware version 16.03.53.12. Systems using this model and firmware are susceptible to the overflow unless a patch or firmware upgrade is applied.

The CVSS score of 8.7 classifies the vulnerability as High severity. No EPSS value is available, but the flaw is public and can be exploited remotely. The vulnerability is not listed in CISA’s KEV catalog, yet its remote nature and high impact make it a strong candidate for immediate action. Exploitation requires network connectivity to the router’s administrative interface and target the Wi‑Fi schedule configuration endpoint.