Technical impact
The vulnerability is a stack-based buffer overflow in the fromP2pListFilter function of the Tenda CX12L firmware version 16.03.53.12. Manipulating the page parameter on the /goform/P2pListFilter endpoint overflows a local buffer. This could corrupt the stack, resulting in either denial of service or the execution of arbitrary code within the context of the router’s firmware. The description does not confirm code execution, but stack overflows typically enable that risk.
Affected Systems
The only product identified by the CNA as affected is the Tenda CX12L model. The specific impacted firmware is 16.03.53.12. No other vendors, products, or versions are listed, so the scope is limited to that firmware release.
Risk and Exploitability
The CVSS base score of 5.1 indicates moderate severity. Exploitation requires access to the same local network, as the vulnerable endpoint must be reached from devices connected to the router. A public exploit has already been released, which suggests that the vulnerability is ready for use by attackers. The EPSS metric is not available, and the vulnerability is not on the CISA KEV catalog, implying that widespread exploitation is not yet documented. As the attack can be carried out from the local network, the most likely vector is a local attacker sending a crafted HTTP request to /goform/P2pListFilter with an oversized page parameter.
