A stack‑based buffer overflow exists in the fromNatStaticSetting function of Tenda JD12L firmware 16.03.53.23. By manipulating the page argument sent to /goform/NatStaticSetting, an attacker can cause a stack overflow that could allow arbitrary code execution. The vulnerability is remotely exploitable and public exploits have already been released, creating a direct threat to affected devices.

Tenda JD12L devices running firmware version 16.03.53.23 are affected. No other firmware versions or related products are listed as vulnerable in the CNA data.

The CVSS score of 8.7 indicates a high severity flaw. Although no EPSS value is available, the fact that the exploit is public and the vulnerability is remotely triggered increases the likelihood of exploitation. The device is not listed in the CISA KEV catalog, but the stack‑based nature of the flaw implies that successful exploitation would grant an attacker control over the device.