CVE-2026-11504
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A stack-based buffer overflow vulnerability has been detected in Tenda CX12L version 16.03.53.12 in the setSchedWifi function of the /goform/openSchedWifi file. Manipulation of the schedStartTime/schedEndTime arguments leads to buffer overflow. The attack can be launched remotely and the exploit is public.
Risk Assessment
Remote exploitation could allow arbitrary code execution on the device, potentially leading to router compromise and network security breach.
Recommendation
Update the Tenda CX12L firmware to the latest version, or temporarily disable remote access to the management interface.
Other vulnerabilities in Tenda CX12L
See all- CVE-2026-11503High
A stack-based buffer overflow vulnerability has been found in Tenda CX12L version 16.03.53.12 in the form_fast_setting_wifi_set function of the /goform/fast_setting_wifi_set file. Manipulation of the ssid argument leads to buffer overflow. The attack can be launched remotely and the exploit is public.
- CVE-2026-5687High
A stack-based buffer overflow vulnerability was identified in the Tenda CX12L device version 16.03.53.12 in the fromNatStaticSetting function of the /goform/NatStaticSetting file. The attack can be performed remotely by manipulating the page argument. The exploit has been made public.
- CVE-2026-5686High
A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic in the file /goform/RouteStatic, where manipulation of the page argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly released.
- CVE-2026-5684High
In Tenda CX12L version 16.03.53.12, the function fromwebExcptypemanFilter in /goform/webExcptypemanFilter is vulnerable to stack-based buffer overflow via manipulation of the argument page. The attack requires local network access, and the exploit is publicly disclosed.
- CVE-2026-5683Medium
Tenda CX12L router version 16.03.53.12 has a stack-based buffer overflow in the fromP2pListFilter function in /goform/P2pListFilter. An attacker from the local network can manipulate the page argument to trigger the overflow.
Original NVD description (English source)
A vulnerability was detected in Tenda CX12L 16.03.53.12. The impacted element is the function setSchedWifi of the file /goform/openSchedWifi of the component Wi-Fi Schedule Configuration Endpoint. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.