EUVD-2026-35038
GHSA-7qr5-4ph4-37p9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach router web UI on LAN or exposed WAN
-
DeliveryAuthenticate with low-privilege or default credentials
-
ExploitPOST oversized ssid to /goform/fast_setting_wifi_set
-
InstallOverflow stack buffer in form_fast_setting_wifi_set
-
C2Overwrite saved return address
-
ExecuteExecute shellcode as root web process
-
ImpactPersist via firmware/config modification for botnet or MITM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Tenda CX12L web management interface on firmware 16.03.53.12 and a valid low-privilege session token sufficient to invoke /goform/fast_setting_wifi_set (per CVSS PR:L); no user interaction and no additional attack requirements are needed (UI:N, AT:N). Practical limits include: the management interface must be reachable from the attacker's network position (default deployments restrict this to LAN), the device must be running the specific 16.03.53.12 firmware build, and the attacker must possess or obtain credentials - though weak/default Tenda credentials are common in the wild, which materially lowers this barrier. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring only low-privilege authentication, with high impact on all three CIA properties on the vulnerable component (VC:H/VI:H/VA:H) and no scope change. The E:P modifier and the public GitHub exploit reference align with VulDB's note that the exploit has been disclosed, materially raising practical risk. The CVE is not listed in CISA KEV and no EPSS score was provided, so widespread automated exploitation cannot be confirmed; however, Tenda devices are frequent targets of IoT botnets, so authenticated overflow chains are realistically weaponizable once default or weak credentials are obtained. Note: PR:L conflicts with the description's wording that the 'attack can be launched remotely' without mentioning authentication - verify whether the affected endpoint enforces session checks in the shipping firmware. |
| Exploit ScenarioDerived | An attacker with low-privilege web UI credentials (or who has reached the admin interface through credential reuse, default credentials, or LAN access) sends a crafted POST to /goform/fast_setting_wifi_set with an oversized ssid value, overflowing the stack buffer inside form_fast_setting_wifi_set and overwriting the saved return address. Using the publicly disclosed proof of concept hosted at https://github.com/cve-a/moist/issues/1, the attacker pivots from memory corruption to arbitrary code execution as the web server process, typically root on Tenda firmware, gaining full control of the router for traffic interception, DNS hijacking, or botnet recruitment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Stack-based buffer overflow in the Tenda CX12L router (firmware 16.03.53.12) allows authenticated remote attackers to corrupt memory via the ssid parameter of the /goform/fast_setting_wifi_set endpoint, handled by the form_fast_setting_wifi_set function. Publicly available exploit code exists per VulDB disclosure, raising the likelihood of opportunistic exploitation against exposed management interfaces. The CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact bounded by a low-privilege requirement.
RemediationAI
No vendor-released patch identified at time of analysis; monitor https://www.tenda.com.cn/ and the VulDB entry at https://vuldb.com/vuln/369123 for an updated firmware build that supersedes 16.03.53.12. As compensating controls, restrict access to the device's HTTP management interface to trusted LAN segments only and disable any WAN-side remote administration (trade-off: loss of remote management convenience), enforce strong unique administrator credentials to raise the bar for the low-privilege precondition, and place the router behind a network ACL or upstream firewall that blocks unsolicited inbound HTTP/HTTPS to the device. Where feasible, replace end-of-support consumer Tenda hardware with a supported model, since this vendor has a long history of unpatched goform overflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda CX12L is a consumer/SMB Wi-Fi router whose web management interface exposes /goform/* CGI-style endpoints handled by native C binaries in the embedded Linux firmware. The vulnerable routine form_fast_setting_wifi_set processes the ssid POST parameter without enforcing a bounded copy, producing a CWE-121 stack-based buffer overflow that overwrites the saved return address and adjacent stack frames. Such overflows on MIPS/ARM-based Tenda firmware are a recurring vulnerability class historically leading to control-flow hijack and command execution as the web server process, which typically runs as root on these devices.
Know when Cx12L gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in Tenda CX12L 16.03.53.12. The affected element is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set of the component Wi-Fi Configuration Endpoint. Such manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
The Tenda CX12L router firmware 16.03.53.12 contains a stack buffer overflow vulnerability with publicly available exploit code that allows low-privilege authenticated users to corrupt memory and potentially compromise router operations. Organizations using this device model face direct risk of network infrastructure hijacking, particularly where management interfaces are exposed to trusted networks. Absence of vendor patches requires immediate network isolation and access controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network-layer access to router management interfaces to explicitly authorized administrative networks only; (2) Implement strict egress filtering from management networks to detect potential lateral movement; (3) Enforce strong authentication credentials on management accounts; (4) Deploy real-time monitoring and alerting for access to the /goform/fast_setting_wifi_set endpoint; (5) Maintain detailed audit logs of all administrative interface access with centralized retention and review.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in Tenda CX12L 16.03.53.12 routers allows remote attackers with low privileges to corrupt me
Stack-based buffer overflow in Tenda CX12L router firmware 16.03.53.12 allows authenticated remote attackers to achieve
Remote code execution in Tenda CX12L firmware version 16.03.53.12 allows authenticated attackers to overflow stack buffe
Stack-based buffer overflow in Tenda CX12L wireless router firmware 16.03.53.12 allows authenticated adjacent network at
Stack-based buffer overflow in Tenda CX12L firmware version 16.03.53.12 allows authenticated local network attackers to
Exploit-DB