Executive brief
A security vulnerability has been identified in the Tenda CX12L router, a device used for home and business networking. An attacker can exploit this flaw to cause the device to crash or potentially take full control of the router. This could lead to unauthorized monitoring of network traffic, service outages, or the use of the router as a stepping stone to attack other devices on the internal network.
Technical details
A stack-based buffer overflow vulnerability exists in the Tenda CX12L router firmware version 16.03.53.12. The flaw is located in the 'fromAddressNat' function within the '/goform/addressNat' endpoint. The root cause is the unsafe use of 'sprintf' to process the user-controlled 'page' parameter into a fixed-size 256-byte buffer without length validation. A remote attacker can exploit this by sending a specially crafted POST request with an oversized 'page' argument. Successful exploitation can lead to memory corruption, allowing for denial of service (DoS) or arbitrary code execution (ACE) by overwriting the return address on the stack. A public proof-of-concept (PoC) is available.
Affected products
- Tenda CX12L 16.03.53.12
Timeline
- 2026-03-30: disclosed: Vulnerability details and PoC shared on GitHub by researcher.
- 2026-04-06: advisory: Initial publication of CVE-2026-5685.