Cx12L Firmware CVE-2026-5686

Requires authentication to access Tenda CX12L router running firmware version 16.03.53.12. Attacker must have valid login credentials to reach the /goform/RouteStatic endpoint and manipulate the 'page' parameter to trigger stack-based buffer overflow.

CVSS 7.4 (High) reflects network-based attack vector (AV:N), low complexity (AC:L), and no user interaction (UI:N), but requires low-privilege authentication (PR:L), limiting exposure to scenarios where attackers have compromised credentials or default credentials remain unchanged. The CVSS 4.0 vector confirms Proof-of-Concept exploit availability (E:P), significantly elevating practical risk beyond theoretical scoring. Publicly available exploit code exists per the description and GitHub reference, enabling even moderately skilled attackers to target vulnerable devices. Without EPSS data, we cannot quantify probabilistic exploitation likelihood, but the combination of public POC, consumer IoT target, and typical poor patch adoption in SOHO routers suggests elevated real-world risk. No CISA KEV listing indicates no confirmed mass exploitation campaigns at analysis time, though consumer router compromises are often underreported. Authentication requirement provides partial mitigation, but default credential reuse and credential stuffing attacks against management interfaces are common. SSVC assessment: Exploitation status is POC-public, automatable given POC availability, technical impact is high (arbitrary code execution with router privileges), mission impact depends on network segmentation but typically allows lateral movement. Priority is medium-to-high for internet-facing management interfaces, lower for properly segmented administrative networks.

An attacker identifies a Tenda CX12L router with internet-exposed management interface through Shodan or similar reconnaissance. After obtaining credentials via default password lists (many Tenda devices ship with admin/admin) or credential stuffing, the attacker authenticates to the web interface and submits a crafted HTTP POST request to /goform/RouteStatic with an oversized 'page' parameter exceeding buffer boundaries. The stack overflow overwrites the return address, redirecting execution to attacker-controlled shellcode that establishes a reverse shell with root-level router access. From this foothold, the attacker pivots to internal network reconnaissance, performs DNS hijacking to redirect traffic, or enrolls the device in a botnet for DDoS attacks. Given publicly available exploit code per the vulnerability description and GitHub reference, this attack requires minimal technical sophistication beyond adapting the published POC to specific network conditions.