EUVD-2026-40014
GHSA-38gh-hfgh-77mp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable management endpoint (AV:N) with low complexity, but the web UI requires at least low-privilege authentication (PR:L); a stack overflow on a mitigation-free router yields full C/I/A impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A flaw has been found in Tenda JD12L 16.03.53.23. The impacted element is the function formWifiBasicSet of the file /goform/WifiBasicSet. Executing a manipulation of the argument security_5g can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used.
AnalysisAI
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) allows remote attackers to corrupt memory by manipulating the security_5g argument sent to the formWifiBasicSet handler at /goform/WifiBasicSet, potentially achieving denial of service or arbitrary code execution on the device. The flaw is network-reachable but, per the CVSS 4.0 vector, requires low-level authentication (PR:L), and publicly available exploit code exists. There is no public exploit identified as actively exploited in CISA KEV, and the EPSS score was not provided.
Technical ContextAI
The Tenda JD12L is a consumer/SOHO wireless router whose web management interface exposes /goform/ endpoints handled by native C functions in the embedded HTTP server (httpd). The vulnerable function formWifiBasicSet processes WiFi basic configuration parameters, and the security_5g argument (the 5GHz wireless security/encryption setting) is copied into a fixed-size stack buffer without adequate bounds checking. This maps to CWE-121 (Stack-based Buffer Overflow): attacker-controlled input overruns the buffer boundary on the call stack, overwriting the saved return address and adjacent stack data. The affected product is identified by CPE cpe:2.3:a:tenda:jd12l, and such MIPS/ARM-based embedded routers typically lack modern exploit mitigations (no ASLR/stack canaries), making stack overflows readily exploitable for control-flow hijacking.
RemediationAI
No vendor-released patch identified at time of analysis; Tenda had not published a fixed firmware version in the provided data, and JD12L-class devices are frequently slow to receive or never receive security updates. As compensating controls, disable remote/WAN administration so the web UI is not reachable from the internet, and restrict access to the LAN-side management interface to trusted hosts only (for example via VLAN segmentation or a host firewall), accepting that this complicates legitimate remote management. Change default administrator credentials and enforce strong passwords, since exploitation requires authentication (PR:L) - strong unique credentials raise the bar; place the device behind a separate firewall that blocks unsolicited inbound requests to /goform/WifiBasicSet. Monitor the vendor site (https://www.tenda.com.cn/) for a firmware update and the VulDB advisory (https://vuldb.com/cve/CVE-2026-13517) for fix tracking; if the device is end-of-life, plan replacement with a supported router.
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets remote attackers corrupt memory via th
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets a remote attacker corrupt memory by ma
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today