Which versions of Tenda CX12L are affected by CVE-2026-5684?

Tenda CX12L wireless routers running firmware 16.03.53.12 are vulnerable to authenticated remote code execution via a stack buffer overflow, allowing attackers on the same network to compromise…

Is there a public PoC exploit available for CVE-2026-5684?

Yes, a public proof-of-concept exploit is available for CVE-2026-5684. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5684?

Within 24 hours: Audit network inventory to identify all Tenda CX12L devices and document firmware versions; check Tenda support portal for firmware updates beyond 16.03.53.12. Within 7 days: Isolate any CX12L devices running firmware 16.03.53.12 to a segregated VLAN or replace with patched alternatives; restrict administrative access to local network only. Within 30 days: Complete replacement or firmware upgrade of all CX12L units to a confirmed patched version; implement network segmentation to minimize adjacent network access to critical assets.

Tenda CX12L CVE-2026-5684

Q: What is the CVSS score of CVE-2026-5684?

CVE-2026-5684 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19514 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-06 VulDB

GHSA-phcm-xmm8-7jpc

Tenda Buffer Overflow Stack Overflow

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 29, 2026 - 01:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 29, 2026 - 01:11 vuln.today

cvss_changed

CVSS changed

Apr 29, 2026 - 01:11 NVD

8.6 (HIGH) 7.3 (HIGH)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 21:46 euvd

EUVD-2026-19514

Analysis Generated

Apr 06, 2026 - 21:46 vuln.today

CVE Published

Apr 06, 2026 - 21:15 nvd

HIGH 8.6

DescriptionCVE.org

A vulnerability was determined in Tenda CX12L 16.03.53.12. Affected by this issue is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack requires access to the local network. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stack-based buffer overflow in Tenda CX12L wireless router firmware 16.03.53.12 allows authenticated adjacent network attackers to execute arbitrary code or crash the device via crafted 'page' parameter to the /goform/webExcptypemanFilter endpoint. Publicly available exploit code exists (GitHub POC published), enabling straightforward exploitation against unpatched routers on the same LAN segment. EPSS score of 0.03% suggests limited mass exploitation to date, though adjacent network requirement naturally constrains attack surface to local/corporate networks rather than internet-wide scanning.

Technical ContextAI

This is a classic stack-based buffer overflow (CWE-121) in embedded device firmware. The vulnerable function fromwebExcptypemanFilter processes HTTP form data submitted to /goform/webExcptypemanFilter without proper bounds checking on the 'page' parameter. When an oversized value is provided, it overwrites the function's stack frame, potentially overwriting return addresses or function pointers. CPE 2.3 string identifies the affected asset as Tenda CX12L router firmware. Tenda consumer routers typically run lightweight RTOS or Linux-based firmware with web management interfaces implemented in C/C++, making them susceptible to memory corruption vulnerabilities when input validation is insufficient. The stack overflow occurs server-side during form processing, meaning successful exploitation grants full device privileges.

RemediationAI

No vendor-released patch identified at time of analysis. Check Tenda's official support site (https://www.tenda.com.cn/) for firmware updates newer than 16.03.53.12 that may address this vulnerability. Until patched firmware is available, implement these compensating controls: (1) Restrict web management interface access to specific administrator IP addresses via router access control lists, reducing attack surface to trusted management hosts only (trade-off: impacts remote management convenience). (2) Disable remote/WAN-side management entirely if not required, ensuring the vulnerable endpoint is only accessible from LAN side (trade-off: eliminates legitimate remote admin). (3) Implement network segmentation to isolate management VLAN from general user networks, requiring attackers to first pivot through network boundaries (trade-off: adds infrastructure complexity). (4) Monitor authentication logs for unusual login patterns to the web interface, as PR:L requirement means attacker must authenticate first. (5) Consider replacing affected devices with alternative router models if Tenda does not release timely security updates. VulDB advisory available at https://vuldb.com/vuln/355511 and exploit POC at https://github.com/cve-a/lvdan/issues/2.