EUVD-2026-40015
GHSA-rh6c-34q4-p28r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable goform endpoint with low complexity and no user interaction, but requires authenticated low-privilege web access (PR:L); stack overflow on the device yields high C/I/A within an unchanged scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in Tenda JD12L 16.03.53.23. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument page leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
AnalysisAI
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets a remote attacker corrupt memory by manipulating the 'page' parameter handled by the fromAddressNat function at the /goform/addressNat endpoint, potentially achieving code execution or device crash. Publicly available exploit code exists and the issue was disclosed by VulDB, though there is no public exploit identified as actively exploited in the wild. With a CVSS 4.0 base score of 7.4 and PR:L, exploitation requires some level of authenticated access to the web management interface.
Technical ContextAI
The affected component is the embedded HTTP management server of the Tenda JD12L, a consumer-grade networking device. The /goform/addressNat handler invokes fromAddressNat, which copies the attacker-controlled 'page' request argument into a fixed-size stack buffer without adequate bounds checking - the classic CWE-121 (Stack-based Buffer Overflow) root cause. On the MIPS/ARM SoCs typical of Tenda goform-based firmware, such overflows overwrite saved return addresses on the stack, and because these binaries usually lack modern mitigations (ASLR, stack canaries, NX), they are frequently leveraged for reliable control-flow hijacking. The single affected CPE is cpe:2.3:a:tenda:jd12l, matching firmware build 16.03.53.23.
RemediationAI
No vendor-released patch identified at time of analysis - the references point only to VulDB tracking entries (https://vuldb.com/vuln/374526) and a public exploit issue (https://github.com/cve-a/Vampirensa/issues/4), not to a fixed firmware build. Monitor https://www.tenda.com.cn/ for an updated firmware release for the JD12L and apply it once published. As compensating controls: restrict access to the device's web management interface so the /goform/addressNat endpoint is not reachable from untrusted networks (disable remote/WAN management and limit LAN admin access to trusted hosts/VLANs), which prevents network delivery of the malicious 'page' argument at the cost of losing remote administration convenience; change default and weak credentials since exploitation requires low-privilege access (PR:L); and place the device behind a firewall or segment that blocks inbound HTTP to the management port. If the device is end-of-life or unpatched, consider replacing it with a supported model.
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets remote attackers corrupt memory via th
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) allows remote attackers to corrupt memory b
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today