Description
A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-04-06
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A stack-based buffer overflow has been identified in the fromRouteStatic function of the /goform/RouteStatic file on Tenda CX12L routers. By manipulating the page argument, an attacker can overflow the stack and potentially execute arbitrary code, giving them full control over the device.

Affected Systems

The flaw affects Tenda CX12L routers running firmware version 16.03.53.12. No other versions or products are currently listed as impacted.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, indicating high severity. An exploit is publicly available, and the attack can be performed remotely through the web interface, making it easy for threat actors to target the device. The exception of EPSS data and lack of KEV listing do not diminish the urgency, as remote exploitation is straightforward and could lead to a loss of confidentiality, integrity, and availability of the network.

Generated by OpenCVE AI on April 7, 2026 at 01:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update from Tenda that resolves the stack-based overflow in the /goform/RouteStatic endpoint.
  • If a patch is not yet available, restrict or block external access to the /goform/RouteStatic endpoint using firewall rules or network segmentation.
  • Ensure the router is only exposed to trusted internal networks and disable unnecessary remote management services.
  • Monitor router logs for suspicious activity that may indicate exploitation attempts.

Generated by OpenCVE AI on April 7, 2026 at 01:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Apr 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Tenda cx12l Firmware
CPEs cpe:2.3:h:tenda:cx12l:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:cx12l_firmware:16.03.53.12:*:*:*:*:*:*:*
Vendors & Products Tenda cx12l Firmware

Tue, 07 Apr 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 07 Apr 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Tenda
Tenda cx12l
Vendors & Products Tenda
Tenda cx12l

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Title Tenda CX12L RouteStatic fromRouteStatic stack-based overflow
Weaknesses CWE-119
CWE-121
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Cx12l Cx12l Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-07T16:22:16.370Z

Reserved: 2026-04-06T10:14:13.187Z

Link: CVE-2026-5686

cve-icon Vulnrichment

Updated: 2026-04-07T16:22:13.551Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-06T22:16:24.880

Modified: 2026-04-29T22:35:43.700

Link: CVE-2026-5686

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-07T09:36:38Z

Weaknesses