CVE-2026-5687
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was identified in the Tenda CX12L device version 16.03.53.12 in the fromNatStaticSetting function of the /goform/NatStaticSetting file. The attack can be performed remotely by manipulating the page argument. The exploit has been made public.
Risk Assessment
A remote attack could lead to arbitrary code execution on the device, potentially resulting in full compromise of the device and network.
Recommendation
It is recommended to immediately disconnect the device from the network and contact the vendor for a firmware update or replace it with a supported model.
Other vulnerabilities in Tenda CX12L
See all- CVE-2026-11504High
A stack-based buffer overflow vulnerability has been detected in Tenda CX12L version 16.03.53.12 in the setSchedWifi function of the /goform/openSchedWifi file. Manipulation of the schedStartTime/schedEndTime arguments leads to buffer overflow. The attack can be launched remotely and the exploit is public.
- CVE-2026-11503High
A stack-based buffer overflow vulnerability has been found in Tenda CX12L version 16.03.53.12 in the form_fast_setting_wifi_set function of the /goform/fast_setting_wifi_set file. Manipulation of the ssid argument leads to buffer overflow. The attack can be launched remotely and the exploit is public.
- CVE-2026-5686High
A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic in the file /goform/RouteStatic, where manipulation of the page argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly released.
- CVE-2026-5684High
In Tenda CX12L version 16.03.53.12, the function fromwebExcptypemanFilter in /goform/webExcptypemanFilter is vulnerable to stack-based buffer overflow via manipulation of the argument page. The attack requires local network access, and the exploit is publicly disclosed.
- CVE-2026-5683Medium
Tenda CX12L router version 16.03.53.12 has a stack-based buffer overflow in the fromP2pListFilter function in /goform/P2pListFilter. An attacker from the local network can manipulate the page argument to trigger the overflow.
Original NVD description (English source)
A weakness has been identified in Tenda CX12L 16.03.53.12. This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. This manipulation of the argument page causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.