Cx12L Firmware CVE-2026-5686

The vulnerability resides in the fromRouteStatic function handling static routing configuration at /goform/RouteStatic in Tenda CX12L firmware 16.03.53.12. Classified as CWE-119 (Improper Restriction of Operations within Memory Buffer Bounds), the flaw stems from inadequate input validation of the 'page' parameter, causing a stack-based buffer overflow when oversized data is processed. This memory corruption class enables control-flow hijacking, typically allowing execution of attacker-supplied shellcode. Tenda CX12L is a consumer-grade wireless router, and like many IoT devices, its embedded web server often lacks modern exploit mitigations such as stack canaries, ASLR, or DEP, making exploitation more reliable. The /goform/ path is a common pattern in Tenda's web management interface, handling configuration submissions. Stack-based overflows differ from heap-based variants in their predictability, as stack layout is generally more deterministic, though successful exploitation still requires precise offset calculation to overwrite return addresses without corrupting critical data.