EUVD-2026-40015
GHSA-rh6c-34q4-p28r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to JD12L web interface
-
DeliverySend crafted request to /goform/addressNat
-
ExploitOverflow stack buffer via oversized 'page'
-
ExecutionOverwrite saved return address
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the /goform/addressNat endpoint and supplying a malicious 'page' argument to the fromAddressNat function, and per the CVSS vector PR:L the attacker must hold at least low-privilege/authenticated access to the device's web management interface (it is not a fully unauthenticated PR:N flaw). Limiting factors: the management interface must be network-reachable from the attacker (so devices that block WAN-side admin access and restrict LAN admin are substantially harder to hit), only the JD12L on firmware 16.03.53.23 is confirmed affected, and no user interaction is required (UI:N). The presence of a public POC lowers the practical skill barrier once those conditions are met. |
| Impact | Signals are mixed-to-moderate. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC/VI/VA:H) indicates a network-reachable, low-complexity attack with high impact to confidentiality, integrity and availability, but PR:L means the attacker needs at least low-privilege/authenticated access to the device - a meaningful limiter that argues against unauthenticated mass exploitation. The exploit-maturity sub-metric (E:P) and the 'publicly available' POC confirm proof-of-concept code exists, raising practical risk above a paper-only finding. No EPSS score and no CISA KEV listing were provided, so there is no evidence of active, widespread exploitation; this looks like a disclosed-with-POC consumer router bug rather than a confirmed campaign target. The realistic priority is moderate: high impact on affected devices, but constrained by required authentication, niche product footprint, and lack of KEV/EPSS escalation signals. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the Tenda JD12L web interface (e.g., a logged-in user, a compromised LAN host, or a device with exposed/weak management credentials) sends a crafted HTTP request to /goform/addressNat with an oversized 'page' parameter. The fromAddressNat function copies it into a stack buffer, overwriting the return address; given the public POC and typical lack of router mitigations, this can crash the device or execute attacker-supplied code with the web server's privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 29, 2026
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets a remote attacker corrupt memory by manipulating the 'page' parameter handled by the fromAddressNat function at the /goform/addressNat endpoint, potentially achieving code execution or device crash. Publicly available exploit code exists and the issue was disclosed by VulDB, though there is no public exploit identified as actively exploited in the wild. With a CVSS 4.0 base score of 7.4 and PR:L, exploitation requires some level of authenticated access to the web management interface.
Earlier versions of this analysis (2)
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets a remote, authenticated attacker corrupt memory by supplying an oversized 'page' parameter to the fromAddressNat handler at /goform/addressNat. Successful exploitation can crash the device or potentially achieve arbitrary code execution on the router. Publicly available exploit code exists (disclosed via VulDB/GitHub), but the issue is not listed in CISA KEV and no active exploitation has been confirmed.
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets remote attackers corrupt memory through the fromAddressNat handler reachable at the /goform/addressNat web endpoint by supplying an oversized 'page' argument. Publicly available exploit code exists (disclosed via VulDB and a GitHub issue tracker), and the CVSS 4.0 vector (PR:L) indicates exploitation requires low-level authentication to the device. No public evidence of active in-the-wild exploitation has been identified, but the combination of a working POC and a network-reachable management interface makes this a credible target.
RemediationAI
No vendor-released patch identified at time of analysis - the references point only to VulDB tracking entries (https://vuldb.com/vuln/374526) and a public exploit issue (https://github.com/cve-a/Vampirensa/issues/4), not to a fixed firmware build. Monitor https://www.tenda.com.cn/ for an updated firmware release for the JD12L and apply it once published. As compensating controls: restrict access to the device's web management interface so the /goform/addressNat endpoint is not reachable from untrusted networks (disable remote/WAN management and limit LAN admin access to trusted hosts/VLANs), which prevents network delivery of the malicious 'page' argument at the cost of losing remote administration convenience; change default and weak credentials since exploitation requires low-privilege access (PR:L); and place the device behind a firewall or segment that blocks inbound HTTP to the management port. If the device is end-of-life or unpatched, consider replacing it with a supported model.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded HTTP management server of the Tenda JD12L, a consumer-grade networking device. The /goform/addressNat handler invokes fromAddressNat, which copies the attacker-controlled 'page' request argument into a fixed-size stack buffer without adequate bounds checking - the classic CWE-121 (Stack-based Buffer Overflow) root cause. On the MIPS/ARM SoCs typical of Tenda goform-based firmware, such overflows overwrite saved return addresses on the stack, and because these binaries usually lack modern mitigations (ASLR, stack canaries, NX), they are frequently leveraged for reliable control-flow hijacking. The single affected CPE is cpe:2.3:a:tenda:jd12l, matching firmware build 16.03.53.23.
Know when Jd12L gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable goform endpoint with low complexity and no user interaction, but requires authenticated low-privilege web access (PR:L); stack overflow on the device yields high C/I/A within an unchanged scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in Tenda JD12L 16.03.53.23. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument page leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Tenda JD12L routers (firmware 16.03.53.23 and earlier versions) contain a remotely exploitable stack buffer overflow enabling authenticated attackers to crash devices or achieve code execution, directly compromising network infrastructure security. Publicly available exploit code exists, increasing practical exploitation risk. No vendor patch is currently available, leaving organizations with no standard remediation path.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict management interface access to hardened bastion host or VPN with MFA; (2) Disable remote management features, enable local-only access; (3) Implement network segmentation isolating router management plane from general network traffic; (4) Deploy network-based anomaly detection to monitor device behavior; (5) Develop and execute hardware replacement plan targeting affected units within 30-90 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB