Cx12L Firmware CVE-2026-5687

Requires authenticated access to Tenda CX12L router running firmware version 16.03.53.12. Attacker must be logged into the web interface and craft a malicious request to /goform/NatStaticSetting with an oversized 'page' parameter to trigger stack-based buffer overflow.

Real-world risk is elevated due to multiple converging factors. The CVSS 4.0 vector shows network attack vector (AV:N), low complexity (AC:L), and no user interaction required (UI:N), making exploitation straightforward once authenticated. The PR:L (Low Privileges Required) indicates authentication is needed, which reduces exposure compared to unauthenticated flaws but still permits exploitation by any user with router admin credentials. Publicly available exploit code exists (E:P in CVSS vector and GitHub POC reference), significantly lowering the barrier to exploitation. The vulnerability is NOT confirmed actively exploited (no CISA KEV listing), distinguishing this from immediate-response priorities. However, consumer routers are frequently exposed to internet-facing management interfaces through default configurations or UPnP vulnerabilities, expanding attack surface. SSVC assessment suggests monitoring priority: exploitation is POC-level, technically impactful (potential RCE), and while not currently widespread, the existence of public exploit code creates weaponization risk. Organizations using Tenda CX12L in network perimeters should prioritize remediation; home users face moderate risk if default admin credentials remain unchanged or management interfaces are exposed to WAN.

An attacker who has obtained or guessed the administrative credentials for a Tenda CX12L router (common scenario with default/weak passwords) connects to the web management interface over the network. They craft a malicious HTTP request to the /goform/NatStaticSetting endpoint with an oversized 'page' parameter value containing shellcode and stack frame manipulation data. The vulnerable fromNatStaticSetting function copies this input into a fixed-size stack buffer without bounds checking, overwriting the return address with attacker-controlled values. When the function returns, execution redirects to the injected shellcode, granting the attacker arbitrary code execution with the privileges of the router's web server process - typically root-level on embedded devices. The attacker establishes persistent backdoor access, intercepts network traffic, or pivots to attack internal network hosts. Publicly available exploit code at https://github.com/cve-a/lvdan/issues/5 provides proof-of-concept implementation, enabling even moderately skilled attackers to weaponize this vulnerability.