The firmware of the Tenda JD12L router contains a stack-based buffer overflow in the formWifiBasicSet function (located in /goform/WifiBasicSet). A crafted value of the security_5g parameter can overflow the stack, potentially hijacking execution flow. Because the endpoint is reachable over the network, the flaw can be triggered remotely, and published exploits indicate that it can be used to execute arbitrary code on the device.

Affected are Tenda routers with the JD12L model running firmware version 16.03.53.23. No other versions are listed as vulnerable in the available data.

The vulnerability has a CVSS score of 8.7, classifying it as high severity. The EPSS score is unavailable, but the flaw is not listed in the CISA KEV catalog, which suggests it is not known to be widely exploited in the wild yet. Nonetheless, the presence of a published exploit and the ability to trigger the overflow remotely make the risk significant. A successful exploitation would likely allow the attacker to execute arbitrary code on the router, compromising the confidentiality, integrity, and availability of the device and potentially the network it serves.