Tenda CX12L CVE-2026-8138

Successful exploitation requires authenticated access to the Tenda CX12L web management interface (PR:L in CVSS vector), specifically a user account with privileges to modify PPTP server configuration settings, which typically means administrator-level credentials. The router must be running vulnerable firmware version 16.03.53.12. The attack surface is the /goform/SetPptpServerCfg endpoint accessible via the router's HTTP/HTTPS management interface. No user interaction is required beyond the initial authentication (UI:N). The PPTP server feature itself does not need to be actively enabled, as the vulnerability exists in the configuration handler. Limiting factors include: attacker must have network connectivity to the management interface (typically TCP 80/443), must possess or obtain valid admin credentials, and the router must be powered on and responsive. Default configurations with internet-exposed management interfaces and default credentials present the highest risk profile.

Real-world risk is elevated for internet-exposed Tenda CX12L routers with authenticated management access. The CVSS 4.0 score of 7.4 with vector AV:N/AC:L/PR:L indicates network-accessible exploitation with low complexity requiring only low-privilege (authenticated) access. While authentication is required (PR:L), many consumer routers use default or weak admin credentials, effectively reducing this barrier. The publicly available GitHub POC (E:P in CVSS vector) means exploitation is trivial for anyone with valid credentials. High impact ratings (VC:H/VI:H/VA:H) reflect complete device compromise capability. However, the lack of CISA KEV listing and scope unchanged (SC:N/SI:N/SA:N) suggest exploitation remains targeted rather than widespread. Primary risk factors are: exposed management interfaces, credential reuse, and the device's role as a network perimeter security control. Organizations using these routers for VPN access should treat this as critical. Home users face lower immediate risk unless management interfaces are exposed to the internet, though lateral movement from compromised internal networks remains possible.

An attacker identifies a Tenda CX12L router with web management exposed to the internet or accessible from a compromised internal network. After obtaining valid administrative credentials through credential stuffing, phishing, or exploiting default passwords, the attacker authenticates to the web interface and navigates to the PPTP server configuration page. Using the public GitHub POC exploit, they craft a malicious HTTP POST request to /goform/SetPptpServerCfg with oversized parameters that trigger the stack buffer overflow in formSetPPTPServer, overwriting the return address to redirect execution to attacker-controlled shellcode. This grants root-level code execution on the router, allowing installation of persistent backdoors, traffic interception, pivot attacks into the internal network, or complete device takeover.