Which versions of Tenda CX12L are affected by CVE-2026-11503?

The Tenda CX12L router firmware 16.03.53.12 contains a stack buffer overflow vulnerability with publicly available exploit code that allows low-privilege authenticated users to corrupt memory and…

Is there a public PoC exploit available for CVE-2026-11503?

Yes, a public proof-of-concept exploit is available for CVE-2026-11503. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-11503?

24 hours: Identify all Tenda CX12L routers running firmware 16.03.53.12 in production; map network exposure of management interfaces; block unauthorized network access to the /goform/fast_setting_wifi_set endpoint at the firewall level. 7 days: Implement network segmentation isolating router management access to dedicated administrative subnets; enable comprehensive audit logging of management interface authentication attempts and activities; assess whether any routers have experienced unauthorized administrative access. 30 days: Develop replacement strategy and procurement plan for alternative router vendors with active security patching; establish vendor communication protocol to monitor for future Tenda firmware patches; complete device migrations where feasible.

Tenda CX12L CVE-2026-11503

Q: What is the CVSS score of CVE-2026-11503?

CVE-2026-11503 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35038 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-08 VulDB

GHSA-7qr5-4ph4-37p9

Tenda Stack Overflow Buffer Overflow Cx12L

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:37 vuln.today

CVSS changed

Jun 08, 2026 - 10:22 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A security vulnerability has been detected in Tenda CX12L 16.03.53.12. The affected element is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set of the component Wi-Fi Configuration Endpoint. Such manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Stack-based buffer overflow in the Tenda CX12L router (firmware 16.03.53.12) allows authenticated remote attackers to corrupt memory via the ssid parameter of the /goform/fast_setting_wifi_set endpoint, handled by the form_fast_setting_wifi_set function. Publicly available exploit code exists per VulDB disclosure, raising the likelihood of opportunistic exploitation against exposed management interfaces. The CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact bounded by a low-privilege requirement.

Technical ContextAI

The Tenda CX12L is a consumer/SMB Wi-Fi router whose web management interface exposes /goform/* CGI-style endpoints handled by native C binaries in the embedded Linux firmware. The vulnerable routine form_fast_setting_wifi_set processes the ssid POST parameter without enforcing a bounded copy, producing a CWE-121 stack-based buffer overflow that overwrites the saved return address and adjacent stack frames. Such overflows on MIPS/ARM-based Tenda firmware are a recurring vulnerability class historically leading to control-flow hijack and command execution as the web server process, which typically runs as root on these devices.

RemediationAI

No vendor-released patch identified at time of analysis; monitor https://www.tenda.com.cn/ and the VulDB entry at https://vuldb.com/vuln/369123 for an updated firmware build that supersedes 16.03.53.12. As compensating controls, restrict access to the device's HTTP management interface to trusted LAN segments only and disable any WAN-side remote administration (trade-off: loss of remote management convenience), enforce strong unique administrator credentials to raise the bar for the low-privilege precondition, and place the router behind a network ACL or upstream firewall that blocks unsolicited inbound HTTP/HTTPS to the device. Where feasible, replace end-of-support consumer Tenda hardware with a supported model, since this vendor has a long history of unpatched goform overflows.