Tenda CX12L CVE-2026-5684

Adjacent network access to the Tenda CX12L router (AV:A) - attacker must be on the same local network segment, connected via WiFi or wired LAN. Low-privilege authentication (PR:L) to the web management interface is required, meaning attacker needs valid credentials (any user account, not necessarily admin). The vulnerable endpoint /goform/webExcptypemanFilter must be accessible, which is default configuration for Tenda routers with web management enabled. Limiting factors that reduce real-world risk: (1) Adjacent network requirement prevents internet-wide exploitation, constraining attackers to those with physical proximity or VPN access. (2) Authentication requirement means attacker cannot exploit anonymously - must have valid user credentials first. (3) Consumer routers often deployed in home/SOHO environments with fewer authenticated users than enterprise systems. (4) Web management interface may be disabled in security-conscious deployments, eliminating attack surface entirely.

Real-world risk is MODERATE despite the 7.3 CVSS score. The CVSS vector indicates adjacent network access required (AV:A), meaning attackers must already be on the same LAN/WLAN segment - not exploitable from the internet without prior network compromise. Low attack complexity (AC:L) and low privileges required (PR:L) indicate that once an attacker has network access and valid credentials (even guest/low-privilege user), exploitation is straightforward. Total technical impact (VC:H/VI:H/VA:H) confirms complete device compromise. SSVC framework rates this as POC exploitation status (confirmed public exploit), non-automatable (requires adjacent access and auth), with total technical impact - these factors together suggest targeted exploitation rather than mass scanning. EPSS 0.03% (10th percentile) supports this assessment: the adjacent network requirement creates a natural barrier to widespread exploitation. However, for organizations using these routers internally, risk is HIGH because the public POC lowers attacker skill requirements and authenticated users (employees, contractors, guests on corporate WiFi) represent legitimate insider threat vectors. Not listed in CISA KEV, indicating no confirmed widespread exploitation campaigns. Primary risk scenarios: malicious insiders, compromised employee credentials, evil twin WiFi attacks to gain adjacent access.

An attacker gains valid low-privilege credentials to the Tenda CX12L web interface (via phishing, default credentials, or as a legitimate guest user). From a device on the same WiFi network, they submit a specially crafted HTTP POST request to /goform/webExcptypemanFilter with an oversized 'page' parameter value designed to overflow the stack buffer. The overflow overwrites critical stack data including the return address, redirecting execution to attacker-controlled shellcode that establishes persistent backdoor access or pivots deeper into the corporate network. Public POC code from GitHub (https://github.com/cve-a/lvdan/issues/2) provides ready-made exploit requiring minimal modification.