Which versions of Tenda are affected by EUVD-2026-19541?

Tenda CX12L router firmware version 16.03.53.12 contains a remote code execution vulnerability that allows authenticated users to crash the device or execute arbitrary commands through a stack buffer…

Is there a public PoC exploit available for EUVD-2026-19541?

Yes, a public proof-of-concept exploit is available for EUVD-2026-19541. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-19541?

Within 24 hours: Identify and inventory all Tenda CX12L devices running firmware 16.03.53.12 in your network; restrict administrative console access to trusted personnel only. Within 7 days: Implement network segmentation to isolate affected routers from sensitive systems; monitor authentication logs for unauthorized access attempts to the /goform/addressNat endpoint. Within 30 days: Contact Tenda support for available firmware updates or prepare devices for replacement; deploy alternative routing solutions if no patched firmware version is released.

Tenda EUVD-2026-19541

Q: What is the CVSS score of EUVD-2026-19541?

EUVD-2026-19541 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5685 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-06 VulDB

GHSA-frp6-hv3g-9wcp

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 22:52 vuln.today

cvss_changed

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 21:46 euvd

EUVD-2026-19541

Analysis Generated

Apr 06, 2026 - 21:46 vuln.today

CVE Published

Apr 06, 2026 - 21:30 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was identified in Tenda CX12L 16.03.53.12. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

Remote code execution in Tenda CX12L firmware version 16.03.53.12 allows authenticated attackers to overflow stack buffers via malicious 'page' parameter values sent to the addressNat endpoint (/goform/addressNat). The fromAddressNat function fails to validate input length, enabling memory corruption with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists (GitHub POC), elevating practical exploitation risk despite requiring low-privilege authentication. EPSS data not available, but CVSS 7.4 reflects network-accessible attack vector with low complexity.

Technical ContextAI

This vulnerability affects the Tenda CX12L router firmware (CPE: cpe:2.3:a:tenda:cx12l:*:*:*:*:*:*:*:*), specifically version 16.03.53.12. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), occurring in the fromAddressNat function within the /goform/addressNat component responsible for Network Address Translation configuration. Stack-based buffer overflows occur when unchecked user input exceeds allocated stack memory boundaries, allowing attackers to overwrite adjacent memory including return addresses and function pointers. In embedded router firmware, these components typically handle web-based management interfaces, where CGI-like form handlers process HTTP parameters. The 'page' argument lacks proper bounds checking before being copied to a fixed-size stack buffer, creating the overflow condition. Successful exploitation can redirect program execution flow to attacker-controlled code or cause denial of service through crashes.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations should immediately check Tenda's support portal (https://www.tenda.com.cn/) for firmware updates addressing CVE-2026-5685 or contact Tenda technical support directly for remediation guidance. As interim risk mitigation, disable remote management access to the router's web interface, restricting administrative access to trusted internal networks only. Implement network segmentation to isolate vulnerable devices from critical assets. Change default administrative credentials to strong, unique passwords to raise the authentication barrier. Monitor router logs for suspicious access attempts to /goform/addressNat endpoints. Consider replacing affected devices with alternative router models if vendor patches are not released within acceptable risk timelines. Review VulDB references (https://vuldb.com/vuln/355512 and https://vuldb.com/vuln/355512/cti) for ongoing threat intelligence updates and community-reported mitigation strategies.