Which versions of Tenda JD12L are affected by CVE-2026-13516?

The Tenda JD12L router (firmware 16.03.53.23) contains a buffer overflow vulnerability in the WiFi guest configuration handler that enables denial of service and potential remote code execution on…

How to fix or mitigate CVE-2026-13516?

24 hours: Conduct inventory of all Tenda JD12L routers running firmware 16.03.53.23 and document network exposure; assess whether guest WiFi functionality is critical to business operations. 7 days: Implement network segmentation to isolate affected routers from critical systems; disable WiFi guest functionality if not operationally required; restrict management access via firewall rules. 30 days: Monitor Tenda security advisories for patch availability; schedule immediate firmware upgrade to the patched version upon release.

Tenda JD12L CVE-2026-13516

Q: What is the CVSS score of CVE-2026-13516?

CVE-2026-13516 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-40013 HIGH

Buffer Overflow (CWE-119)

2026-06-29 cna@vuldb.com

GHSA-5pgf-rmhp-rm7j

Tenda Buffer Overflow

7.4

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web endpoint (AV:N/AC:L), but PR:L since the goform handler requires authenticated web-UI access; memory corruption yields high C/I/A impact on the device.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 00:31 vuln.today

DescriptionCVE.org

A vulnerability was detected in Tenda JD12L 16.03.53.23. The affected element is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet. Performing a manipulation of the argument shareSpeed results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

AnalysisAI

Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets remote, low-privileged attackers corrupt memory by supplying an oversized shareSpeed value to the fromSetWifiGusetBasic handler at /goform/WifiGuestSet, enabling denial of service and potential remote code execution on the device. Publicly available exploit code exists, though there is no public exploit identified as actively used in the wild. The EPSS-style risk is moderate per the CVSS 4.0 base score of 7.4 (HIGH), and CISA KEV does not list it.

Technical ContextAI

The affected component is the embedded web management interface of the Tenda JD12L, a consumer/SOHO Wi-Fi device. The /goform/WifiGuestSet endpoint maps to the native C function fromSetWifiGusetBasic, which handles guest-network configuration. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer): the shareSpeed parameter is copied into a fixed-size stack buffer without bounds checking, a recurring pattern in Tenda's MIPS/ARM-based goform handlers where attacker-controlled HTTP parameters are passed to unsafe string operations. No CPE strings were supplied in the input, so the exact affected configuration set is limited to the single firmware build named in the description (16.03.53.23).

RemediationAI

No vendor-released patch identified at time of analysis - the Tenda reference is only the corporate homepage, and no fixed firmware version is cited in the input. As compensating controls, restrict access to the router's web administration interface to trusted management hosts only and ensure it is never exposed to the WAN/internet, which removes the primary remote attack path. Change default administrator credentials and enforce strong passwords, since the PR:L vector implies authentication is a prerequisite; this directly raises the bar for exploitation with no functional side effect beyond credential management. If the guest Wi-Fi configuration feature is not needed, avoid exposing /goform/WifiGuestSet by disabling the guest network, accepting the trade-off of losing guest isolation functionality. Monitor the Tenda site (https://www.tenda.com.cn/) and VulDB (https://vuldb.com/vuln/374524) for a patched firmware release and apply it once available.