Description
A vulnerability has been found in Tenda JD12L 16.03.53.23. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument page leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Published: 2026-06-29
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack‑based buffer overflow exists in the fromAddressNat function of the /goform/addressNat endpoint on the Tenda JD12L router. The flaw is triggered by manipulating the page argument, which can overflow the stack and potentially allow arbitrary code execution. The vulnerability is classified as a high‑severity flaw, with a CVSS score of 8.7, and the exploit has been publicly disclosed.

Affected Systems

The affected device is the Tenda JD12L router running firmware version 16.03.53.23. No other vendors or product versions are listed as impacted.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, and while EPSS data is not available, the lack of a KEV listing does not imply the vulnerability has been exploited in the wild as of now. The likelihood of exploitation is judged to be moderate based on the public disclosure and remote nature of the attack vector. The attack vector is inferred to be remote, via the web interface exposed on the router, and could allow an unauthenticated attacker who can reach the endpoint to achieve full code execution.

Generated by OpenCVE AI on June 29, 2026 at 01:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest firmware update from Tenda that patches the stack overflow in the /goform/addressNat handler – this patch adds proper bounds checking to the page parameter.
  • If a patch cannot be applied immediately, block or restrict external access to the /goform/addressNat URL using router firewall rules or ACLs to eliminate the attack surface until the firmware can be updated.
  • If NAT or address translation is not essential for your network, disable the feature on the router to remove the vulnerable code path altogether.

Generated by OpenCVE AI on June 29, 2026 at 01:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 30 Jun 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 29 Jun 2026 00:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Tenda JD12L 16.03.53.23. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument page leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Title Tenda JD12L addressNat fromAddressNat stack-based overflow
First Time appeared Tenda
Tenda jd12l
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:h:tenda:jd12l:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda jd12l
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Jd12l
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-30T17:57:37.992Z

Reserved: 2026-06-28T06:45:48.210Z

Link: CVE-2026-13518

cve-icon Vulnrichment

Updated: 2026-06-30T17:57:34.174Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-29T04:15:03Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow