Which versions of Tenda are affected by CVE-2026-5686?

Tenda CX12L routers running firmware 16.03.53.12 are vulnerable to authenticated remote code execution through a stack buffer overflow in the RouteStatic configuration endpoint, allowing attackers…

How to fix or mitigate CVE-2026-5686?

Within 24 hours: Identify and inventory all Tenda CX12L devices running firmware 16.03.53.12 in your environment; restrict administrative access to RouteStatic endpoint via network segmentation or WAF rules if available. Within 7 days: Change all router administrative credentials to maximum complexity standards; isolate affected routers to dedicated management VLANs with strict access controls; contact Tenda support for firmware release timeline. Within 30 days: Deploy patched firmware version (pending Tenda release) immediately upon availability; conduct access log review for unauthorized configuration changes; perform network intrusion detection tuning for RouteStatic exploitation patterns.

Tenda CVE-2026-5686

Q: What is the CVSS score of CVE-2026-5686?

CVE-2026-5686 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19543 HIGH

Buffer Overflow (CWE-119)

2026-04-06 cna@vuldb.com

GHSA-fc6j-rjwv-62c9

Tenda Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 22:37 vuln.today

cvss_changed

EUVD ID Assigned

Apr 06, 2026 - 22:22 euvd

EUVD-2026-19543

Analysis Generated

Apr 06, 2026 - 22:22 vuln.today

CVE Published

Apr 06, 2026 - 22:16 nvd

HIGH 7.4

DescriptionCVE.org

A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Remote stack-based buffer overflow in Tenda CX12L router firmware version 16.03.53.12 allows authenticated attackers to execute arbitrary code via crafted 'page' parameter to the RouteStatic configuration endpoint. CVSS 7.4 with publicly available exploit code (E:P in vector). EPSS and KEV data not provided, but public POC availability elevates immediate risk for exposed management interfaces.

Technical ContextAI

The vulnerability resides in the fromRouteStatic function handling static routing configuration at /goform/RouteStatic in Tenda CX12L firmware 16.03.53.12. Classified as CWE-119 (Improper Restriction of Operations within Memory Buffer Bounds), the flaw stems from inadequate input validation of the 'page' parameter, causing a stack-based buffer overflow when oversized data is processed. This memory corruption class enables control-flow hijacking, typically allowing execution of attacker-supplied shellcode. Tenda CX12L is a consumer-grade wireless router, and like many IoT devices, its embedded web server often lacks modern exploit mitigations such as stack canaries, ASLR, or DEP, making exploitation more reliable. The /goform/ path is a common pattern in Tenda's web management interface, handling configuration submissions. Stack-based overflows differ from heap-based variants in their predictability, as stack layout is generally more deterministic, though successful exploitation still requires precise offset calculation to overwrite return addresses without corrupting critical data.

RemediationAI

No vendor-released patch identified at time of analysis based on provided references. Organizations should immediately check Tenda's official support portal at https://www.tenda.com.cn/ for firmware updates post-dating version 16.03.53.12. As interim mitigations, disable remote management access to the router's administrative interface, restrict administrative access to trusted internal IP ranges only via firewall rules or the router's access control features, change default administrative credentials to strong unique passwords, and implement network segmentation to isolate router management interfaces from untrusted networks. Monitor authentication logs for unusual login attempts to /goform/ endpoints. Consider replacing affected devices with actively supported hardware if Tenda does not release timely security updates, as consumer IoT products often have limited patch lifecycles. Do not expose the web management interface (typically ports 80/443/8080) to the public internet under any circumstances.