Which versions of Tenda CX12L are affected by CVE-2026-8138?

Tenda CX12L routers running firmware 16.03.53.12 contain a stack-based buffer overflow in the PPTP configuration interface that permits authenticated attackers to gain complete system control.

Is there a public PoC exploit available for CVE-2026-8138?

Yes, a public proof-of-concept exploit is available for CVE-2026-8138. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-8138?

Within 24 hours: inventory all Tenda CX12L routers in your environment and document firmware versions currently deployed. Within 7 days: immediately isolate any CX12L devices running firmware 16.03.53.12 from untrusted networks and restrict administrative access to authorized personnel only; change all default and shared administrative credentials. Within 30 days: contact Tenda for patch availability and timeline; evaluate replacement of affected devices with vendors providing active security updates, or implement network segmentation to limit PPTP configuration access to isolated administrative networks only.

Tenda CX12L CVE-2026-8138

Q: What is the CVSS score of CVE-2026-8138?

CVE-2026-8138 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28529 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-08 VulDB

GHSA-v5fc-fw74-r356

Stack Overflow Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 05:31 vuln.today

CVSS changed

May 08, 2026 - 05:22 NVD

8.8 (HIGH) 7.4 (HIGH)

CVE Published

May 08, 2026 - 04:15 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was found in Tenda CX12L 16.03.53.12. This issue affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg”. The manipulation results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

AnalysisAI

Stack-based buffer overflow in Tenda CX12L router firmware 16.03.53.12 allows authenticated remote attackers to achieve full system compromise via the PPTP server configuration interface. The vulnerability resides in the formSetPPTPServer function within /goform/SetPptpServerCfg and is exploitable over the network with low attack complexity. A public proof-of-concept exploit exists on GitHub, significantly lowering the barrier to exploitation, though CISA has not yet added this to the KEV catalog indicating no confirmed widespread active exploitation at this time.

Technical ContextAI

This vulnerability stems from a classic stack-based buffer overflow (CWE-121) in the PPTP (Point-to-Point Tunneling Protocol) server configuration handler of Tenda CX12L router firmware. The affected function formSetPPTPServer in the SetPptpServerCfg endpoint fails to properly validate input length before copying data to a fixed-size stack buffer. PPTP is a legacy VPN protocol commonly implemented in consumer routers for remote access. When processing configuration parameters through the web management interface at /goform/SetPptpServerCfg, attackers can supply oversized input that overwrites adjacent stack memory, including return addresses, enabling arbitrary code execution with the privileges of the web server process (typically root on embedded devices). The CPE identifier cpe:2.3:a:tenda:cx12l confirms this affects the Tenda CX12L product line specifically at firmware version 16.03.53.12.

RemediationAI

No vendor-released patched firmware version has been identified at time of analysis despite the vulnerability disclosure. Users should immediately check the official Tenda support portal at https://www.tenda.com.cn/ for any firmware updates beyond version 16.03.53.12. As compensating controls until a patch is available: disable remote management access to the router's web interface entirely if not required, restricting access to local network only; change default administrative credentials to strong unique passwords to raise the authentication barrier; implement network-level access controls (firewall rules, VLANs) to limit who can reach the management interface on TCP ports 80/443; disable the PPTP server feature completely if not actively used for VPN access, as this removes the vulnerable attack surface. For organizations with compliance requirements, consider replacing affected devices with alternative router models until Tenda releases verified security updates. Note that disabling PPTP will break existing VPN configurations and require migration to alternative VPN protocols like WireGuard or OpenVPN.