EUVD-2026-40016
GHSA-q964-w32c-4cr5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliveryAuthenticate with low-priv credentials
-
ExploitPOST oversized 'page' to /goform/NatStaticSetting
-
ExecutionOverflow stack buffer in fromNatStaticSetting
-
ImpactHijack control flow or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the router's HTTP management interface and at least low-privileged authentication (CVSS PR:L), then sending a request to the /goform/NatStaticSetting endpoint with a malicious 'page' argument that triggers the fromNatStaticSetting stack overflow. Limiting factors: the attacker must be able to reach the web UI (typically LAN-side unless remote management is enabled) and must possess valid low-level credentials, though weak/default SOHO credentials often satisfy this; only firmware 16.03.53.23 is confirmed affected. No user interaction is required (UI:N). |
| Impact | Signals are partly conflicting and should be weighed carefully. The CVSS 4.0 base score is 7.4 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and full V-C/V-I/V-A High, and E:P confirms proof-of-concept exploit maturity rather than confirmed active exploitation. PR:L means the attacker needs at least low-level authentication to the web UI - on many SOHO devices this is a weak or default credential, lowering the practical barrier, but it is NOT unauthenticated. No EPSS score and no KEV listing are provided, so there is no evidence of mass or active exploitation; this reads as a real-but-not-urgent issue typical of high-volume VulDB router disclosures. The only source is VulDB and a GitHub issue PoC, with no independent vendor confirmation, so treat reliability accordingly. Net: a genuine remotely-reachable memory-corruption bug worth patching, but absent KEV/EPSS evidence it is lower real-world priority than an unauthenticated, actively-exploited flaw. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface and holds low-privilege credentials (or default/guessable ones) sends a crafted HTTP request to /goform/NatStaticSetting with an oversized 'page' parameter, overflowing the stack buffer in fromNatStaticSetting. This can crash the device (denial of service) or, with a reliable payload, achieve code execution on the router. Public PoC code exists, lowering the effort required to reproduce the crash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 29, 2026
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets remote attackers corrupt memory via the 'page' parameter handled by the fromNatStaticSetting function at the /goform/NatStaticSetting endpoint. Publicly available exploit code exists, and the CVSS 4.0 vector (PR:L) indicates an authenticated user on the device's web interface can trigger high confidentiality, integrity and availability impact. There is no public exploit identified as actively used in the wild - exploitation is proof-of-concept only at this time.
Earlier versions of this analysis (2)
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets a remote attacker corrupt memory via the fromNatStaticSetting handler of the /goform/NatStaticSetting endpoint by supplying an oversized 'page' argument. Publicly available exploit code exists, but the issue is not listed in CISA KEV, so there is no public exploit identified as actively exploited at this time. The CVSS 4.0 vector (PR:L) indicates the attack is remote but requires some level of authentication to the device's web interface.
Remote stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets attackers corrupt memory via the fromNatStaticSetting handler for the /goform/NatStaticSetting endpoint by manipulating the 'page' argument. Public exploit code exists, raising the practical risk despite no confirmed active exploitation. The CVSS 4.0 vector (8.7) indicates network-reachable exploitation requiring low privileges, with high impact to confidentiality, integrity, and availability of the device.
RemediationAI
No vendor-released patch is identified at time of analysis; Tenda has not published a fixed firmware version in the available data, so monitor https://www.tenda.com.cn/ for an updated build and apply it once released. As compensating controls, restrict access to the device's web management interface to trusted management VLANs or hosts and disable remote/WAN-side administration so the /goform/NatStaticSetting endpoint is not reachable from untrusted networks (trade-off: remote management convenience is lost). Change default and weak administrator credentials, since exploitation requires low-privilege authentication (PR:L), and place the device behind a firewall that blocks inbound access to its HTTP(S) admin port. Reference the disclosure at https://vuldb.com/cve/CVE-2026-13519; the public PoC is at https://github.com/cve-a/Yuanji-Wanshu/issues/1.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded web management server (httpd/goform handler) of the Tenda JD12L, a consumer/SOHO networking device, identified by CPE cpe:2.3:a:tenda:jd12l:*:*:*:*:*:*:*:*. The root cause is CWE-121 (Stack-based Buffer Overflow): the fromNatStaticSetting routine that processes NAT static-routing configuration copies the attacker-controlled 'page' argument into a fixed-size stack buffer without adequate bounds checking. Tenda's goform handlers are a well-known pattern for these flaws, typically using unsafe string operations (e.g., strcpy/sprintf) on HTTP request parameters, allowing the saved return address or adjacent stack data to be overwritten.
Know when Jd12L gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Remotely reachable web endpoint (AV:N/AC:L) but requires low-privilege authentication to the admin UI (PR:L); stack overflow enables code execution with full C/I/A impact on the device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in Tenda JD12L 16.03.53.23. This impacts the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
Executive ViewAI
Tenda JD12L routers running firmware 16.03.53.23 are vulnerable to remote code execution through a stack-based buffer overflow, with publicly available exploit code currently in circulation. An authenticated user with access to the device's web management interface can trigger complete compromise of router functionality and access to network traffic. The absence of a vendor patch creates an immediate operational risk for organizations relying on these devices for critical network infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict web management interface access to authorized management networks using firewall rules; disable remote management if not operationally critical; implement network segmentation using VLANs to isolate affected devices; deploy IDS/IPS rules to detect exploitation attempts targeting the /goform/NatStaticSetting endpoint with suspicious 'page' parameters; enforce strong credentials on web management interfaces; maintain detailed audit logs of all web interface access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB