EUVD-2026-35039
GHSA-pjjg-3c99-jj57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach router web UI on LAN or exposed WAN
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend crafted POST to /goform/openSchedWifi with oversized schedStartTime/schedEndTime
-
InstallOverflow stack buffer in setSchedWifi
-
C2Hijack control flow in HTTP daemon
-
ExecuteExecute code as root on device
-
ImpactPivot into LAN or persist on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Tenda CX12L web management interface (TCP port 80/443 on the LAN by default; WAN-side only if remote management is enabled) and a low-privilege authenticated session per CVSS PR:L - meaning valid credentials to the router's web UI are needed to reach the /goform/openSchedWifi handler and invoke setSchedWifi. The specific trigger is sending crafted values in the schedStartTime or schedEndTime POST parameters of the Wi-Fi Schedule Configuration Endpoint on firmware 16.03.53.12. No user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is limited by: (1) need for a valid web-UI credential, (2) reachability of the management interface from the attacker's network position, and (3) the device specifically running CX12L firmware 16.03.53.12 - other Tenda models or firmware revisions are not confirmed vulnerable from the provided data. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H and E:P (Proof-of-Concept) scores 7.4 and indicates a network-reachable, low-complexity attack requiring some level of privilege but no user interaction, with high impact on the vulnerable component. PR:L signals an authenticated condition - typically a logged-in administrative or guest session on the router's web UI - which tempers risk somewhat, but Tenda devices are commonly deployed with weak or default credentials, narrowing that gap considerably. Publicly available exploit code (referenced via the GitHub issue tracker tied to VulDB submission 835649) elevates real-world exploitability, though the vulnerability is not in CISA KEV and no EPSS score was provided in the input, so widespread automated exploitation cannot be confirmed from the available data. Net assessment: a credible priority for anyone operating CX12L devices on the firmware in question, particularly where the management interface is exposed beyond a trusted LAN. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privilege session on the router's web UI - for example via default or guessed credentials, a CSRF chain from a LAN client, or pivoting from another compromised host on the LAN - sends a crafted POST request to /goform/openSchedWifi with oversized schedStartTime or schedEndTime values. The publicly available proof-of-concept linked from https://github.com/cve-a/moist/issues/2 demonstrates the parameter overflow, which can crash the web management daemon (denial of service) or, with appropriate payload crafting given the embedded device's memory protections, redirect execution to attacker-controlled code running with the privileges of the router's HTTP server, typically root on Tenda firmware. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 08, 2026
Stack-based buffer overflow in Tenda CX12L 16.03.53.12 routers allows remote attackers with low privileges to corrupt memory via the setSchedWifi function in /goform/openSchedWifi by manipulating the schedStartTime or schedEndTime parameters. Publicly available exploit code exists per VulDB, raising the practical risk despite the vulnerability not yet being listed in CISA KEV. The flaw impacts the Wi-Fi Schedule Configuration Endpoint and can lead to high confidentiality, integrity, and availability impact on the device.
Earlier versions of this analysis (2)
Stack-based buffer overflow in the Tenda CX12L router (firmware 16.03.53.12) allows remote authenticated attackers to corrupt memory and likely achieve code execution by sending crafted schedStartTime or schedEndTime arguments to the /goform/openSchedWifi endpoint. Publicly available exploit code exists per VulDB, increasing immediate risk for exposed management interfaces, though there is no public exploit identified at time of analysis as CISA KEV-listed active exploitation. The CVSS 4.0 base score of 7.4 reflects network reachability with low privileges and high impact to confidentiality, integrity, and availability of the device.
Stack-based buffer overflow in Tenda CX12L router firmware 16.03.53.12 allows authenticated remote attackers to corrupt memory by sending crafted schedStartTime or schedEndTime values to the /goform/openSchedWifi endpoint handled by setSchedWifi. Publicly available exploit code exists per VulDB, and successful exploitation can lead to full device compromise with high confidentiality, integrity, and availability impact. No CISA KEV listing or EPSS score has been provided, so prioritization should rely on the CVSS 8.8 rating and public POC availability.
RemediationAI
No vendor-released patch identified at time of analysis; the Tenda advisory page (https://www.tenda.com.cn/) and VulDB entry (https://vuldb.com/vuln/369124) should be monitored for an updated firmware build superseding 16.03.53.12. As compensating controls, restrict access to the router's web administration interface to a trusted management VLAN or specific admin IPs via the device's ACL settings (side effect: remote administration from arbitrary networks is lost), ensure the WAN-side HTTP/HTTPS management is disabled so /goform/openSchedWifi cannot be reached from the internet (default on most Tenda firmware but verify), rotate the admin credential to a strong unique password to raise the PR:L bar, and where feasible disable the Wi-Fi schedule feature or place the device behind an upstream firewall that filters POST requests to /goform/openSchedWifi. Network monitoring for unexpected admin-session POSTs to that endpoint is a reasonable detection layer until firmware is updated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in the embedded HTTP management server of the Tenda CX12L router (CPE cpe:2.3:a:tenda:cx12l:*), specifically the setSchedWifi handler reachable through the /goform/openSchedWifi endpoint used to configure scheduled Wi-Fi on/off periods. The root cause is CWE-121 (Stack-based Buffer Overflow): user-supplied schedStartTime and schedEndTime values are copied into fixed-size stack buffers without adequate length validation, a recurring pattern in Tenda's goform-based web administration binaries that typically use strcpy/sprintf on attacker-controlled POST parameters. Successful corruption of the saved return address or stack metadata in the MIPS/ARM web server process can divert execution flow, and because these embedded devices generally lack modern mitigations (ASLR, stack canaries, NX are inconsistent on Tenda firmware), exploitation toward code execution is realistic.
Know when Cx12L gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in Tenda CX12L 16.03.53.12. The impacted element is the function setSchedWifi of the file /goform/openSchedWifi of the component Wi-Fi Schedule Configuration Endpoint. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.
Executive ViewAI
The Tenda CX12L router (version 16.03.53.12) contains a stack-based buffer overflow vulnerability enabling remote, low-privilege attackers to corrupt device memory and disrupt Wi-Fi scheduling functionality. Publicly available exploit code exists, elevating practical exploitation risk for organizations deploying this router model. Urgent device identification and remediation is required to prevent service outages and potential network compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: implement strict network access controls restricting connections to affected routers; isolate devices on dedicated management network segment; monitor logs for exploitation attempts; disable Wi-Fi scheduling features if operationally feasible; expedite replacement hardware procurement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in the Tenda CX12L router (firmware 16.03.53.12) allows authenticated remote attackers to co
Stack-based buffer overflow in Tenda CX12L router firmware 16.03.53.12 allows authenticated remote attackers to achieve
Remote code execution in Tenda CX12L firmware version 16.03.53.12 allows authenticated attackers to overflow stack buffe
Stack-based buffer overflow in Tenda CX12L wireless router firmware 16.03.53.12 allows authenticated adjacent network at
Stack-based buffer overflow in Tenda CX12L firmware version 16.03.53.12 allows authenticated local network attackers to
Exploit-DB