EUVD-2026-40014
GHSA-38gh-hfgh-77mp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach router web interface (LAN or exposed WAN)
-
DeliveryAuthenticate with low-privilege/default credentials
-
ExploitSend crafted POST to /goform/WifiBasicSet
-
InstallOverflow stack via oversized security_5g
-
C2Overwrite saved return address
-
ExecuteExecute payload or crash httpd
-
ImpactGain control of router or cause denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires sending a manipulated security_5g parameter to the formWifiBasicSet function via the /goform/WifiBasicSet endpoint of the JD12L web management interface, and per the CVSS 4.0 vector it requires PR:L - a low-privilege authenticated session to that interface - so the attacker must reach the HTTP management service and possess at least limited valid credentials (or exploit default/weak credentials). Limiting factors: the management interface must be network-reachable from the attacker (commonly LAN-only unless remote administration is enabled), authentication is needed (PR:L, not PR:N), no user interaction is required (UI:N), and only firmware 16.03.53.23 of the Tenda JD12L is confirmed affected. These factors mean realistic exposure is largely to attackers already on the local network or to internet-exposed devices with remote admin enabled. |
| Impact | The provided CVSS 4.0 base score is 7.4 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and high confidentiality, integrity, and availability impact to the vulnerable system (VC:H/VI:H/VA:H), with no subsequent-system impact (SC/SI/SA:N). The vector indicates network attack reach with low complexity, but crucially requires PR:L - at least low-privilege authentication, which typically means an authenticated session to the router admin interface. Exploit maturity is marked Proof-of-Concept (E:P), consistent with the report that exploit code has been published. There is no CISA KEV listing and no EPSS probability supplied, so there is no evidence of widespread active exploitation; the realistic risk is moderate and tilts toward targeted exploitation or local-network attackers rather than mass internet-wide compromise. A key caveat: the source is VulDB and the report originates from a GitHub issue, so depth of independent verification is limited, and the PR:L requirement meaningfully constrains the 'remote' framing. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the router's web interface - for example a user on the local network who has obtained or guessed valid management credentials, or who is leveraging a default password - sends a crafted POST request to /goform/WifiBasicSet with an oversized security_5g value. The overflow overwrites the stack return address, crashing the httpd service (denial of service) or, with a tailored payload on a mitigation-free embedded target, executing attacker-supplied code with the router's privileges. Published proof-of-concept exploit code lowers the effort required to reproduce the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 29, 2026
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) allows remote attackers to corrupt memory by manipulating the security_5g argument sent to the formWifiBasicSet handler at /goform/WifiBasicSet, potentially achieving denial of service or arbitrary code execution on the device. The flaw is network-reachable but, per the CVSS 4.0 vector, requires low-level authentication (PR:L), and publicly available exploit code exists. There is no public exploit identified as actively exploited in CISA KEV, and the EPSS score was not provided.
Earlier versions of this analysis (2)
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets an authenticated remote attacker corrupt memory via the security_5g parameter of the /goform/WifiBasicSet endpoint (formWifiBasicSet function), potentially achieving denial of service or arbitrary code execution on the device. A public exploit has been released (VulDB), though the issue is not in CISA KEV and no active exploitation is confirmed. CVSS 4.0 scores it 7.4 (High), reflecting low-privilege network access with full impact to confidentiality, integrity, and availability of the device.
Stack-based buffer overflow in the Tenda JD12L router (firmware 16.03.53.23) lets an authenticated attacker corrupt memory through the web management interface by supplying an oversized security_5g parameter to the formWifiBasicSet handler at /goform/WifiBasicSet, enabling potential remote code execution or device crash. The flaw is reachable over the network and publicly available exploit code exists (disclosed via VulDB), though no active exploitation has been confirmed (not listed in CISA KEV). The CVSS 4.0 base score is 8.7 (High) with high impact to confidentiality, integrity, and availability of the device.
RemediationAI
No vendor-released patch identified at time of analysis; Tenda had not published a fixed firmware version in the provided data, and JD12L-class devices are frequently slow to receive or never receive security updates. As compensating controls, disable remote/WAN administration so the web UI is not reachable from the internet, and restrict access to the LAN-side management interface to trusted hosts only (for example via VLAN segmentation or a host firewall), accepting that this complicates legitimate remote management. Change default administrator credentials and enforce strong passwords, since exploitation requires authentication (PR:L) - strong unique credentials raise the bar; place the device behind a separate firewall that blocks unsolicited inbound requests to /goform/WifiBasicSet. Monitor the vendor site (https://www.tenda.com.cn/) for a firmware update and the VulDB advisory (https://vuldb.com/cve/CVE-2026-13517) for fix tracking; if the device is end-of-life, plan replacement with a supported router.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda JD12L is a consumer/SOHO wireless router whose web management interface exposes /goform/ endpoints handled by native C functions in the embedded HTTP server (httpd). The vulnerable function formWifiBasicSet processes WiFi basic configuration parameters, and the security_5g argument (the 5GHz wireless security/encryption setting) is copied into a fixed-size stack buffer without adequate bounds checking. This maps to CWE-121 (Stack-based Buffer Overflow): attacker-controlled input overruns the buffer boundary on the call stack, overwriting the saved return address and adjacent stack data. The affected product is identified by CPE cpe:2.3:a:tenda:jd12l, and such MIPS/ARM-based embedded routers typically lack modern exploit mitigations (no ASLR/stack canaries), making stack overflows readily exploitable for control-flow hijacking.
Know when Jd12L gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable management endpoint (AV:N) with low complexity, but the web UI requires at least low-privilege authentication (PR:L); a stack overflow on a mitigation-free router yields full C/I/A impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in Tenda JD12L 16.03.53.23. The impacted element is the function formWifiBasicSet of the file /goform/WifiBasicSet. Executing a manipulation of the argument security_5g can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used.
Executive ViewAI
Tenda JD12L routers (firmware version 16.03.53.23) contain a vulnerability allowing authenticated network users to disrupt operations or potentially gain control of the device, directly threatening network availability and security. The vendor has not yet released a patch, and publicly available exploit code exists, creating active risk. Organizations must immediately secure these devices with access controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network access controls via firewall ACLs to restrict management interface access to authorized administrators only; (2) Disable remote management services where not operationally required; (3) Segment router management network traffic onto a protected administrative VLAN; (4) Enforce multi-factor authentication for administrative access; (5) Monitor network traffic to affected devices for suspicious patterns indicative of exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB