EUVD-2026-40013
GHSA-5pgf-rmhp-rm7j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliverySend crafted POST to /goform/WifiGuestSet
-
ExploitOverflow stack buffer via oversized shareSpeed
-
ExecutionHijack execution in fromSetWifiGusetBasic
-
ImpactCrash device or run code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires sending a manipulated shareSpeed argument to the fromSetWifiGusetBasic function via the /goform/WifiGuestSet endpoint on a Tenda JD12L running firmware 16.03.53.23. Per the CVSS 4.0 vector, PR:L indicates the attacker needs low-level privileges - i.e., authenticated access to the router's web UI (commonly satisfied by default or weak credentials) - and no user interaction (UI:N) is needed. The key limiting factors are: network reachability of the management interface (typically LAN-only unless remote management is enabled) and possession of valid (even low-privilege) credentials. Exploitation is constrained to the specific JD12L model and firmware build named; other models/firmware are not confirmed vulnerable. |
| Impact | Signals are moderately consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H) indicates network-reachable, low-complexity exploitation requiring some privilege (PR:L), with high impact to confidentiality, integrity, and availability of the device - yielding the 7.4 HIGH score. The vector carries E:P (Proof-of-Concept), aligning with the description's statement that exploit code is public; this raises practical risk above a theoretical high-CVSS issue. However, no EPSS score, KEV listing, or SSVC decision data was provided, so widespread or automated exploitation cannot be confirmed. The PR:L requirement implies the attacker likely needs authenticated access to the web UI (e.g., default or weak credentials), which tempers the 'remote' nature: against an internet-exposed panel with default creds this is serious, but it is not a fully unauthenticated takeover. Note the source is VulDB (cna@vuldb.com), a research aggregator, not the vendor - version and impact details are not vendor-confirmed. |
| Exploit ScenarioDerived | An attacker who can reach the JD12L web interface (LAN-side, or WAN-side if the panel is exposed) and holds low-privilege/admin access submits a crafted POST to /goform/WifiGuestSet with an over-length shareSpeed value, overflowing a stack buffer in fromSetWifiGusetBasic. This crashes the device (denial of service) and, with a tailored payload on this MIPS/ARM target, may redirect execution to attacker-controlled code. Public PoC code referenced in the advisory lowers the effort required to reproduce the crash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 29, 2026
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets remote, low-privileged attackers corrupt memory by supplying an oversized shareSpeed value to the fromSetWifiGusetBasic handler at /goform/WifiGuestSet, enabling denial of service and potential remote code execution on the device. Publicly available exploit code exists, though there is no public exploit identified as actively used in the wild. The EPSS-style risk is moderate per the CVSS 4.0 base score of 7.4 (HIGH), and CISA KEV does not list it.
RemediationAI
No vendor-released patch identified at time of analysis - the Tenda reference is only the corporate homepage, and no fixed firmware version is cited in the input. As compensating controls, restrict access to the router's web administration interface to trusted management hosts only and ensure it is never exposed to the WAN/internet, which removes the primary remote attack path. Change default administrator credentials and enforce strong passwords, since the PR:L vector implies authentication is a prerequisite; this directly raises the bar for exploitation with no functional side effect beyond credential management. If the guest Wi-Fi configuration feature is not needed, avoid exposing /goform/WifiGuestSet by disabling the guest network, accepting the trade-off of losing guest isolation functionality. Monitor the Tenda site (https://www.tenda.com.cn/) and VulDB (https://vuldb.com/vuln/374524) for a patched firmware release and apply it once available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded web management interface of the Tenda JD12L, a consumer/SOHO Wi-Fi device. The /goform/WifiGuestSet endpoint maps to the native C function fromSetWifiGusetBasic, which handles guest-network configuration. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer): the shareSpeed parameter is copied into a fixed-size stack buffer without bounds checking, a recurring pattern in Tenda's MIPS/ARM-based goform handlers where attacker-controlled HTTP parameters are passed to unsafe string operations. No CPE strings were supplied in the input, so the exact affected configuration set is limited to the single firmware build named in the description (16.03.53.23).
Know when Tenda gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint (AV:N/AC:L), but PR:L since the goform handler requires authenticated web-UI access; memory corruption yields high C/I/A impact on the device.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was detected in Tenda JD12L 16.03.53.23. The affected element is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet. Performing a manipulation of the argument shareSpeed results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.
Executive ViewAI
The Tenda JD12L router (firmware 16.03.53.23) contains a buffer overflow vulnerability in the WiFi guest configuration handler that enables denial of service and potential remote code execution on network infrastructure. Publicly available exploit code exists for this vulnerability. Organizations using these routers risk compromised network access points and potential lateral movement into internal networks if the vulnerability is exploited.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Block network access to /goform/WifiGuestSet endpoint via firewall or router ACLs; (2) Disable WiFi guest network if operationally feasible; (3) Implement network segmentation to isolate affected routers from business-critical systems; (4) Enable rate limiting and access logging on management interfaces; (5) Monitor system logs for unusual administrative access patterns and device memory errors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Related Vulnerabilities in Tenda JD12L Buffer Overflow Flaws
View all 5Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function. Rated high sev
Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attacke
The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers to bypass authentication
Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function. Rated critic
In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability
Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function via
Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function via
Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan. Rated critical severity (CV
Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet. Rated critical se
Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp. Rate
Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /
Certain Tenda products are vulnerable to command injection. Rated critical severity (CVSS 9.8), this vulnerability is re
Exploit-DB