Tenda JD12L CVE-2026-13515

Q: What is the CVSS score of CVE-2026-13515?

CVE-2026-13515 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-40012 HIGH

Buffer Overflow (CWE-119)

2026-06-29 cna@vuldb.com

GHSA-m4xx-xhjg-w8v6

Buffer Overflow Tenda

7.4

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web endpoint (AV:N, AC:L) but the supplied 4.0 vector marks PR:L, so low-privilege auth is required; memory corruption yields full code-execution impact (C/I/A:H), scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Jun 29, 2026 - 00:32 cve.org

HIGH 7.4

Analysis Generated

Jun 29, 2026 - 00:30 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in Tenda JD12L 16.03.53.23. Impacted is the function formSetPPTPServer of the file /goform/SetPptpServerCfg. Such manipulation of the argument startIp leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets remote attackers corrupt memory by sending an oversized startIp argument to the formSetPPTPServer handler at /goform/SetPptpServerCfg, potentially achieving denial of service or arbitrary code execution on the device. The flaw is reachable over the network and publicly available exploit code exists, though it is not listed in CISA KEV and the CVSS 4.0 vector indicates low-privilege (authenticated) access is required. EPSS data was not provided, so widespread automated exploitation cannot be confirmed.

Technical ContextAI

The JD12L is a Tenda SOHO/consumer networking device whose web management interface exposes /goform/ endpoints backed by C handlers in the embedded HTTP server (httpd/goahead-style). The vulnerable routine formSetPPTPServer processes the PPTP server configuration form and copies the user-supplied startIp parameter into a fixed-size stack buffer without bounds checking. This is a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) / stack-based buffer overflow: oversized input overruns the buffer and overwrites adjacent stack data including the saved return address, a frequently weaponized pattern in MIPS/ARM-based Tenda firmware where stack canaries and ASLR are typically absent.

RemediationAI

No vendor-released patch or fixed firmware version is identified at time of analysis; the VulDB and GitHub references (https://github.com/cve-a/Vampirensa/issues/1, https://vuldb.com/vuln/374523) document the issue but do not cite a patched build, so monitor https://www.tenda.com.cn/ for a firmware update and apply it once released. As compensating controls, restrict access to the device's web management interface to trusted management VLANs or hosts and ensure it is never exposed to the WAN/Internet (side effect: remote administration becomes unavailable). Disable the PPTP server feature if it is not required, which removes the reachable code path (side effect: loss of PPTP VPN functionality). Change default administrator credentials and enforce strong authentication, since exploitation requires low-privilege access; and place the device behind a firewall that blocks unsolicited inbound connections to the management port.