EUVD-2026-19512
GHSA-r6ph-fxqg-vg33
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS score of 5.1 suggests moderate severity, multiple signals indicate elevated practical risk. The CVSS vector (AV:A/AC:L/PR:L) confirms the attack requires local network access and authenticated privileges, but the presence of publicly available exploit code (POC status marked available) significantly lowers the barrier to weaponization. The attack complexity is low (AC:L), meaning exploitation does not require specialized conditions. The impact scope indicates low confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L), suggesting the overflow may not directly grant code execution or system compromise in its current form but could enable information disclosure or crash the service. However, stack overflow vulnerabilities are historically a stepping stone for privilege escalation or remote code execution with additional payload engineering. The local network requirement and authentication barrier provide some organizational control, but any authenticated user on the network (including compromised IoT devices or guest networks) could exploit this. The combination of public exploit availability, low attack complexity, and memory corruption primitive makes this a legitimate priority for organizations using Tenda CX12L, particularly those with shared or semi-trusted networks. |
| Exploit ScenarioDerived | An authenticated attacker on the same local network (e.g., a compromised IoT device, guest network user, or internal malicious actor) sends a crafted HTTP POST request to /goform/P2pListFilter with an oversized or specially crafted page parameter, triggering a stack-based buffer overflow in the fromP2pListFilter function. This causes memory corruption that could crash the service, leak sensitive data from the stack, or potentially be chained with additional techniques to achieve code execution. Publicly available exploit code documented on GitHub (https://github.com/cve-a/lvdan/issues/1) lowers the skill barrier for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 06, 2026
Stack-based buffer overflow in Tenda CX12L firmware version 16.03.53.12 allows authenticated local network attackers to cause memory corruption via manipulation of the page parameter in the P2pListFilter function. The vulnerability requires local network access and authenticated privileges but carries publicly available exploit code, elevating practical risk despite the moderate CVSS score of 5.1.
RemediationAI
Check the Tenda support page at https://www.tenda.com.cn/ for available firmware updates beyond version 16.03.53.12. Firmware updates from the vendor represent the primary remediation path; apply the latest stable release for CX12L once available. In the interim, implement network segmentation to restrict access to the P2pListFilter endpoint (/goform/P2pListFilter) to trusted management networks only, and disable remote management interfaces if not required. Monitor firewall and IDS logs for suspicious requests to the vulnerable endpoint. If the device is used in environments with untrusted local network access, consider replacing it with alternative equipment from vendors with active security patching practices. Consult VulDB entry https://vuldb.com/vuln/355510 and the CTI page https://vuldb.com/vuln/355510/cti for ongoing updates on available patches.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the P2pListFilter endpoint (/goform/P2pListFilter) within Tenda CX12L network equipment firmware. The root cause is a stack-based buffer overflow (CWE-121) triggered by improper input validation on the page parameter, allowing an attacker to write beyond allocated stack memory boundaries. This is a classic memory safety vulnerability in C-based firmware code where input length is not properly bounded before copying to a fixed-size stack buffer. The affected product is identified via CPE cpe:2.3:a:tenda:cx12l:*:*:*:*:*:*:*:*, indicating all versions of the CX12L application are potentially vulnerable; however, the vulnerability was specifically documented in firmware version 16.03.53.12.
Know when Cx12L gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in Tenda CX12L 16.03.53.12. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack must originate from the local network. The exploit has been made public and could be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in Tenda CX12L 16.03.53.12 routers allows remote attackers with low privileges to corrupt me
Stack-based buffer overflow in the Tenda CX12L router (firmware 16.03.53.12) allows authenticated remote attackers to co
Stack-based buffer overflow in Tenda CX12L router firmware 16.03.53.12 allows authenticated remote attackers to achieve
Remote code execution in Tenda CX12L firmware version 16.03.53.12 allows authenticated attackers to overflow stack buffe
Stack-based buffer overflow in Tenda CX12L wireless router firmware 16.03.53.12 allows authenticated adjacent network at
Exploit-DB