Cx12L CVE-2026-5685

Tenda CX12L firmware version 16.03.53.12. Requires authenticated access to the web management interface. Attacker must send a crafted request to /goform/addressNat endpoint with a malicious 'page' parameter to trigger stack-based buffer overflow.

Real-world risk is moderate-to-high despite the 7.4 CVSS score. CVSS 4.0 vector analysis shows attack vector is network-based (AV:N) with low complexity (AC:L) requiring only low privileges (PR:L) and no user interaction (UI:N), indicating straightforward remote exploitation once authenticated. The vulnerability delivers maximum impact to vulnerable system confidentiality, integrity, and availability (VC:H/VI:H/VA:H) with proof-of-concept exploitation confirmed (E:P). Critically, publicly available exploit code on GitHub substantially lowers the skill barrier for weaponization. However, authentication requirement (PR:L) provides partial mitigation by limiting attack surface to users with valid router credentials. No CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis. SSVC assessment: exploitation is publicly demonstrated (POC available), likely automatable given network access and low complexity, with technical impact of total system compromise. Priority depends on internet exposure of management interfaces-organizations exposing Tenda CX12L admin panels to WAN face immediate risk, while those restricting access to trusted LANs have reduced exposure. The lack of vendor security advisories or confirmed patch availability elevates risk for deployed devices.

An external attacker scans for internet-exposed Tenda CX12L routers via banner grabbing or fingerprinting techniques, identifying devices running vulnerable firmware 16.03.53.12. Using credential stuffing attacks or default password databases, the attacker obtains low-privilege authenticated access to the web management interface. They then craft a malicious HTTP POST request to /goform/addressNat containing an oversized 'page' parameter value designed to overflow the stack buffer in the fromAddressNat function. The overflow overwrites the return address with a pointer to attacker-supplied shellcode embedded in the request, achieving arbitrary code execution with router kernel privileges. Publicly available exploit code on GitHub (https://github.com/cve-a/lvdan/issues/3) provides ready-made weaponization tools, requiring minimal technical expertise to deploy. Post-exploitation, the attacker establishes persistent backdoor access, intercepts network traffic, pivots to internal network segments, or enlists the router into a botnet for DDoS operations.