CVE-2026-5685

Tenda CX12L addressNat fromAddressNat stack-based overflow

View on CVE.org
Published Apr 6, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in Tenda CX12L 16.03.53.12. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

Analysis

AI-generated

Technical impact

A stack-based buffer overflow exists in the fromAddressNat function of Tenda CX12L firmware 16.03.53.12. By manipulating the page argument, an attacker can overwrite memory on the stack, potentially enabling arbitrary code execution on the device. The flaw is triggered through a remote request, and the public exploit raises the risk of a full system compromise. The vulnerability is classified as CWE‑119 and CWE‑121.

Affected Systems

The affected product is the Tenda CX12L wireless router running firmware version 16.03.53.12. No other versions are explicitly listed; users of this specific build are at risk.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity, and the lack of an EPSS rating does not diminish the fact that the exploit is publicly available and can be triggered remotely. While the vulnerability is not currently in the CISA KEV catalog, its remote nature and confirmed exploit code make it a likely target for adversaries. The high score, remote attack vector, and public exploit suggest that the risk is significant and should be addressed promptly.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the router firmware to the latest version released by Tenda
  • If an official patch is not available, disable remote management interfaces or restrict access to trusted IPs
  • Ensure that default credentials have been changed and enforce strong password policies
  • Apply network segmentation or firewall rules to block unnecessary ports used by the vulnerable service
  • Regularly monitor logs for anomalous activity related to the addressNat function

Generated by OpenCVE AI on April 7, 2026 at 01:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Tenda cx12l Firmware
CPEs cpe:2.3:h:tenda:cx12l:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:cx12l_firmware:16.03.53.12:*:*:*:*:*:*:*
Vendors & Products Tenda cx12l Firmware
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Tenda
Tenda cx12l
Vendors & Products Tenda
Tenda cx12l
Type Values Removed Values Added
Description A vulnerability was identified in Tenda CX12L 16.03.53.12. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.
Title Tenda CX12L addressNat fromAddressNat stack-based overflow
Weaknesses CWE-119
CWE-121
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 7, 2026, 3:09 PM
Reserved
Apr 6, 2026, 10:14 AM

View source JSON

Updated
Apr 7, 2026, 2:48 PM

JSON

Status
Analyzed
Published
Apr 6, 2026, 10:16 PM
Modified
Jul 24, 2026, 9:10 AM

View source JSON

No data.

Updated
Apr 7, 2026, 9:36 AM

JSON