I12 CVE-2026-5609

Tenda i12 firmware version 1.0.0.11(3862). Attacker requires authenticated access to the device's web interface. Remote exploitation via POST request to /goform/wifiSSIDset with malicious index/wl_radio parameter triggers stack buffer overflow in formwrlSSIDset function.

The CVSS v3.1 score of 8.8 (High) reflects critical impact across confidentiality, integrity, and availability (all High), with the vector showing network-based exploitation requiring low-privilege authentication (PR:L) and no user interaction (UI:N). The Exploit Maturity indicator (E:P for Proof-of-Concept) aligns with confirmed publicly available exploit code on GitHub, significantly lowering the skill barrier for attackers. While authentication is required (PR:L), consumer routers often retain default credentials or weak passwords, making this requirement a minor obstacle in practice. The lack of remediation level data (RL:X) and the vendor's historical responsiveness to security issues are concerning factors. Real-world risk is elevated because home/SOHO routers are frequently exposed to internet-facing management interfaces either intentionally or through UPnP misconfigurations, and the Tenda i12's target market (consumers and small businesses) typically lacks enterprise-grade security monitoring. The combination of weaponized exploit availability, network accessibility, and the potential for complete device compromise (code execution with router privileges enables DNS hijacking, traffic interception, and lateral movement) makes this a high-priority vulnerability despite the authentication requirement. Without EPSS or KEV data, the publicly available exploit code serves as the strongest exploitation probability signal.

An attacker identifies a Tenda i12 router with network-accessible management interface through internet scanning (common on ports 80/443/8080). Using default or brute-forced credentials to satisfy the low-privilege authentication requirement, the attacker accesses the web interface and navigates to the WiFi configuration page. By crafting a malicious HTTP POST request to /goform/wifiSSIDset with oversized 'index' or 'wl_radio' parameter values as detailed in the public GitHub exploit, the attacker triggers the stack-based buffer overflow in formwrlSSIDset. The overflow overwrites the function's return address with attacker-controlled data, redirecting execution to injected shellcode. With code execution achieved in the router's administrative context, the attacker establishes persistence, modifies DNS settings to redirect traffic through attacker-controlled servers, extracts WiFi credentials and network topology information, or pivots to attack devices on the internal network. The publicly available exploit code significantly reduces the technical expertise required, making this accessible to moderately skilled attackers.