CVE-2026-5686

Tenda CX12L RouteStatic fromRouteStatic stack-based overflow

View on CVE.org
Published Apr 6, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Analysis

AI-generated

Technical impact

A stack-based buffer overflow has been identified in the fromRouteStatic function of the /goform/RouteStatic file on Tenda CX12L routers. By manipulating the page argument, an attacker can overflow the stack and potentially execute arbitrary code, giving them full control over the device.

Affected Systems

The flaw affects Tenda CX12L routers running firmware version 16.03.53.12. No other versions or products are currently listed as impacted.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, indicating high severity. An exploit is publicly available, and the attack can be performed remotely through the web interface, making it easy for threat actors to target the device. The exception of EPSS data and lack of KEV listing do not diminish the urgency, as remote exploitation is straightforward and could lead to a loss of confidentiality, integrity, and availability of the network.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware update from Tenda that resolves the stack-based overflow in the /goform/RouteStatic endpoint.
  • If a patch is not yet available, restrict or block external access to the /goform/RouteStatic endpoint using firewall rules or network segmentation.
  • Ensure the router is only exposed to trusted internal networks and disable unnecessary remote management services.
  • Monitor router logs for suspicious activity that may indicate exploitation attempts.

Generated by OpenCVE AI on April 7, 2026 at 01:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Tenda cx12l Firmware
CPEs cpe:2.3:h:tenda:cx12l:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:cx12l_firmware:16.03.53.12:*:*:*:*:*:*:*
Vendors & Products Tenda cx12l Firmware
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Tenda
Tenda cx12l
Vendors & Products Tenda
Tenda cx12l
Type Values Removed Values Added
Description A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Title Tenda CX12L RouteStatic fromRouteStatic stack-based overflow
Weaknesses CWE-119
CWE-121
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 7, 2026, 4:22 PM
Reserved
Apr 6, 2026, 10:14 AM

View source JSON

Updated
Apr 7, 2026, 4:22 PM

JSON

Status
Analyzed
Published
Apr 6, 2026, 10:16 PM
Modified
Jul 24, 2026, 9:10 AM

View source JSON

No data.

Updated
Apr 7, 2026, 9:36 AM

JSON