Skip to main content

Cx12L Firmware EUVDEUVD-2026-19545

| CVE-2026-5687 HIGH
Buffer Overflow (CWE-119)
2026-04-06 cna@vuldb.com GHSA-qchm-r69c-gh59
7.4
CVSS 4.0 · Vendor: vuldb
Share

Severity by source

Vendor (vuldb) PRIMARY
7.4 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Re-analysis Queued
Apr 29, 2026 - 22:37 vuln.today
cvss_changed
EUVD ID Assigned
Apr 06, 2026 - 22:22 euvd
EUVD-2026-19545
Analysis Generated
Apr 06, 2026 - 22:22 vuln.today
CVE Published
Apr 06, 2026 - 22:16 nvd
HIGH 7.4

DescriptionCVE.org

A weakness has been identified in Tenda CX12L 16.03.53.12. This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. This manipulation of the argument page causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Stack-based buffer overflow in Tenda CX12L router firmware 16.03.53.12 allows authenticated remote attackers to achieve arbitrary code execution via the 'page' parameter in the fromNatStaticSetting function at /goform/NatStaticSetting endpoint. Publicly available exploit code exists. EPSS data not provided, but CVSS 7.4 (High) with network attack vector and low complexity indicates significant risk for exposed administrative interfaces.

Technical ContextAI

This vulnerability resides in the NAT static port mapping configuration handler of Tenda CX12L router firmware. The fromNatStaticSetting function in /goform/NatStaticSetting endpoint fails to properly validate the length of the 'page' parameter before copying it into a fixed-size stack buffer. CWE-119 (Improper Restriction on Operations within the Bounds of a Memory Buffer) represents the root cause - classic stack-based buffer overflow allowing arbitrary memory corruption. Consumer routers frequently implement web-based management interfaces using embedded HTTP servers with insufficient input validation, creating attack surface for memory corruption vulnerabilities. The /goform/ path pattern is characteristic of Tenda's router management interface architecture. Successful exploitation could allow overwriting return addresses on the stack to redirect execution flow, particularly critical given the elevated privileges typically associated with router configuration processes.

RemediationAI

Users should immediately disable remote management access to the Tenda CX12L administrative interface if enabled, restricting access to trusted local networks only until patching is completed. Change default administrative credentials to strong, unique passwords to reduce authentication-based attack surface. Check the official Tenda support portal at https://www.tenda.com.cn/ for firmware updates addressing CVE-2026-5687; no vendor-released patched firmware version is independently confirmed from available data at time of analysis. As an interim mitigation, implement network-level access controls (firewall rules, VLANs) to prevent untrusted users from reaching the router's management interface on TCP ports 80/443. Monitor router logs for unexpected access to /goform/ endpoints or administrative authentication failures that may indicate exploitation attempts. If firmware updates are not available and the device must remain in production, consider replacing the affected router with alternative hardware if it serves critical network security functions. Subscribe to Tenda security advisories and VulDB tracking (https://vuldb.com/vuln/355514/cti) for patch availability notifications.

Share

EUVD-2026-19545 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy