Is there a public PoC exploit available for CVE-2026-5683?

Yes, a public proof-of-concept exploit is available for CVE-2026-5683. Prioritise patching immediately. EPSS: 0.0%.

Tenda CVE-2026-5683

Q: What is the CVSS score of CVE-2026-5683?

CVE-2026-5683 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19512 LOW

Stack-based Buffer Overflow (CWE-121)

2026-04-06 VulDB

GHSA-r6ph-fxqg-vg33

Tenda Buffer Overflow Stack Overflow

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 21:00 euvd

EUVD-2026-19512

Analysis Generated

Apr 06, 2026 - 21:00 vuln.today

CVE Published

Apr 06, 2026 - 20:30 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability was found in Tenda CX12L 16.03.53.12. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack must originate from the local network. The exploit has been made public and could be used.

AnalysisAI

Stack-based buffer overflow in Tenda CX12L firmware version 16.03.53.12 allows authenticated local network attackers to cause memory corruption via manipulation of the page parameter in the P2pListFilter function. The vulnerability requires local network access and authenticated privileges but carries publicly available exploit code, elevating practical risk despite the moderate CVSS score of 5.1.

Technical ContextAI

The vulnerability exists in the P2pListFilter endpoint (/goform/P2pListFilter) within Tenda CX12L network equipment firmware. The root cause is a stack-based buffer overflow (CWE-121) triggered by improper input validation on the page parameter, allowing an attacker to write beyond allocated stack memory boundaries. This is a classic memory safety vulnerability in C-based firmware code where input length is not properly bounded before copying to a fixed-size stack buffer. The affected product is identified via CPE cpe:2.3:a:tenda:cx12l:*:*:*:*:*:*:*:*, indicating all versions of the CX12L application are potentially vulnerable; however, the vulnerability was specifically documented in firmware version 16.03.53.12.

RemediationAI

Check the Tenda support page at https://www.tenda.com.cn/ for available firmware updates beyond version 16.03.53.12. Firmware updates from the vendor represent the primary remediation path; apply the latest stable release for CX12L once available. In the interim, implement network segmentation to restrict access to the P2pListFilter endpoint (/goform/P2pListFilter) to trusted management networks only, and disable remote management interfaces if not required. Monitor firewall and IDS logs for suspicious requests to the vulnerable endpoint. If the device is used in environments with untrusted local network access, consider replacing it with alternative equipment from vendors with active security patching practices. Consult VulDB entry https://vuldb.com/vuln/355510 and the CTI page https://vuldb.com/vuln/355510/cti for ongoing updates on available patches.