EUVD-2026-35039
GHSA-pjjg-3c99-jj57
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was detected in Tenda CX12L 16.03.53.12. The impacted element is the function setSchedWifi of the file /goform/openSchedWifi of the component Wi-Fi Schedule Configuration Endpoint. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.
AnalysisAI
Stack-based buffer overflow in Tenda CX12L 16.03.53.12 routers allows remote attackers with low privileges to corrupt memory via the setSchedWifi function in /goform/openSchedWifi by manipulating the schedStartTime or schedEndTime parameters. Publicly available exploit code exists per VulDB, raising the practical risk despite the vulnerability not yet being listed in CISA KEV. The flaw impacts the Wi-Fi Schedule Configuration Endpoint and can lead to high confidentiality, integrity, and availability impact on the device.
Technical ContextAI
The vulnerability lives in the embedded HTTP management server of the Tenda CX12L router (CPE cpe:2.3:a:tenda:cx12l:*), specifically the setSchedWifi handler reachable through the /goform/openSchedWifi endpoint used to configure scheduled Wi-Fi on/off periods. The root cause is CWE-121 (Stack-based Buffer Overflow): user-supplied schedStartTime and schedEndTime values are copied into fixed-size stack buffers without adequate length validation, a recurring pattern in Tenda's goform-based web administration binaries that typically use strcpy/sprintf on attacker-controlled POST parameters. Successful corruption of the saved return address or stack metadata in the MIPS/ARM web server process can divert execution flow, and because these embedded devices generally lack modern mitigations (ASLR, stack canaries, NX are inconsistent on Tenda firmware), exploitation toward code execution is realistic.
RemediationAI
No vendor-released patch identified at time of analysis; the Tenda advisory page (https://www.tenda.com.cn/) and VulDB entry (https://vuldb.com/vuln/369124) should be monitored for an updated firmware build superseding 16.03.53.12. As compensating controls, restrict access to the router's web administration interface to a trusted management VLAN or specific admin IPs via the device's ACL settings (side effect: remote administration from arbitrary networks is lost), ensure the WAN-side HTTP/HTTPS management is disabled so /goform/openSchedWifi cannot be reached from the internet (default on most Tenda firmware but verify), rotate the admin credential to a strong unique password to raise the PR:L bar, and where feasible disable the Wi-Fi schedule feature or place the device behind an upstream firewall that filters POST requests to /goform/openSchedWifi. Network monitoring for unexpected admin-session POSTs to that endpoint is a reasonable detection layer until firmware is updated.
Stack-based buffer overflow in the Tenda CX12L router (firmware 16.03.53.12) allows authenticated remote attackers to co
Remote code execution in Tenda CX12L firmware version 16.03.53.12 allows authenticated attackers to overflow stack buffe
Stack-based buffer overflow in Tenda CX12L wireless router firmware 16.03.53.12 allows authenticated adjacent network at
Stack-based buffer overflow in Tenda CX12L firmware version 16.03.53.12 allows authenticated local network attackers to
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today