CVE-2026-5686
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic in the file /goform/RouteStatic, where manipulation of the page argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly released.
Risk Assessment
Remote stack-based buffer overflow could allow an attacker to execute arbitrary code or crash the device, threatening network integrity and availability.
Recommendation
Immediately update the Tenda CX12L firmware to the latest available version, or apply temporary network restrictions to block access to the vulnerable interface.
Other vulnerabilities in Tenda CX12L
See all- CVE-2026-11504High
A stack-based buffer overflow vulnerability has been detected in Tenda CX12L version 16.03.53.12 in the setSchedWifi function of the /goform/openSchedWifi file. Manipulation of the schedStartTime/schedEndTime arguments leads to buffer overflow. The attack can be launched remotely and the exploit is public.
- CVE-2026-11503High
A stack-based buffer overflow vulnerability has been found in Tenda CX12L version 16.03.53.12 in the form_fast_setting_wifi_set function of the /goform/fast_setting_wifi_set file. Manipulation of the ssid argument leads to buffer overflow. The attack can be launched remotely and the exploit is public.
- CVE-2026-5687High
A stack-based buffer overflow vulnerability was identified in the Tenda CX12L device version 16.03.53.12 in the fromNatStaticSetting function of the /goform/NatStaticSetting file. The attack can be performed remotely by manipulating the page argument. The exploit has been made public.
- CVE-2026-5684High
In Tenda CX12L version 16.03.53.12, the function fromwebExcptypemanFilter in /goform/webExcptypemanFilter is vulnerable to stack-based buffer overflow via manipulation of the argument page. The attack requires local network access, and the exploit is publicly disclosed.
- CVE-2026-5683Medium
Tenda CX12L router version 16.03.53.12 has a stack-based buffer overflow in the fromP2pListFilter function in /goform/P2pListFilter. An attacker from the local network can manipulate the page argument to trigger the overflow.
Original NVD description (English source)
A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.