Tenda JD12L CVE-2026-13515

Exploitation requires reaching the device web server and invoking the formSetPPTPServer handler via the /goform/SetPptpServerCfg endpoint with an oversized startIp parameter, on Tenda JD12L firmware 16.03.53.23. The CVSS 4.0 vector specifies PR:L, so at least low-privilege authenticated access to the management interface is needed - this is the primary limiting factor and means it is not a default-config unauthenticated compromise. Exploitation is further limited by network reachability of the web UI (devices not exposed to WAN require the attacker to be on the LAN/management network) and by the PPTP server configuration path being accessible; no user interaction is required (UI:N).

Signals are mixed-to-moderate. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC/VI/VA:H, score 7.4) indicates a network-reachable attack with low complexity and full impact to confidentiality, integrity and availability of the device, but the PR:L metric means the attacker needs at least low-level authenticated access to the web UI - an important limiter that distinguishes this from a fully unauthenticated takeover. The vector includes E:P (Proof-of-Concept), consistent with the public disclosure, so publicly available exploit code exists; however this is NOT confirmed active exploitation - it is not in CISA KEV. No EPSS score was provided, so real-world exploitation probability cannot be quantified. Net: a genuine, exploitable memory-corruption flaw worth patching on exposed devices, but the authentication requirement and consumer/SOHO footprint make mass exploitation less likely than the high impact metrics alone suggest. Source provenance is VulDB/researcher-submitted rather than vendor-confirmed, which lowers confidence in details.

An attacker who can reach the router's web interface and holds low-privilege credentials (or rides an authenticated session) submits a crafted POST to /goform/SetPptpServerCfg with an over-length startIp value. The overflow overwrites the saved return address, crashing the httpd service or, on these unhardened embedded targets, redirecting execution to attacker-controlled shellcode for full device compromise. Public proof-of-concept exploit code is available, lowering the effort required.