Is CVE-2026-8138 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8138 being exploited in the wild.

How severe is CVE-2026-8138?

High severity, with a CVSS score of 8.8, published 8 May 2026.

Is there a fix for CVE-2026-8138?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8138 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8138?

Check whether you run Tenda Cx12l or Tenda Cx12l Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8138: Tenda CX12L stack overflow in formSetPPTPServer

CVE-2026-8138 · Severity: high · CVSS 8.8 · Published 2026-05-08

A vulnerability exists in the Tenda CX12L router, a device used to provide wireless internet connectivity. An attacker can exploit this flaw to cause the router to crash or potentially take full control of the device. This could lead to a complete loss of internet access, unauthorized monitoring of network traffic, or the use of the router as a jumping-off point to attack other devices on the home or business network.

Technologies: Tenda Cx12l, Tenda Cx12l Firmware. Vendors: Tenda.

Quick answers

Is CVE-2026-8138 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8138 being exploited in the wild.
How severe is CVE-2026-8138?: High severity, with a CVSS score of 8.8, published 8 May 2026.
Which products and versions are affected?: Tenda CX12L 16.03.53.12.
Is there a fix for CVE-2026-8138?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8138 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8138?: Check whether you run Tenda Cx12l or Tenda Cx12l Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow vulnerability exists in the Tenda CX12L router (firmware version 16.03.53.12) within the 'formSetPPTPServer' function of the '/goform/SetPptpServerCfg' endpoint. The root cause is the unsafe use of the 'sscanf' function with an unbounded '%s' format specifier when parsing the 'startIp' parameter. A remote attacker can exploit this by sending a specially crafted POST request with an oversized 'startIp' value. Successful exploitation can lead to memory corruption, allowing for arbitrary code execution or a denial-of-service (DoS) condition by crashing the web server process. While some metrics suggest low privileges are required, the researcher's PoC indicates the vulnerability may be triggerable without authentication.

Affected products

Tenda CX12L 16.03.53.12

Timeline

2026-04-21: disclosed: Vulnerability details and PoC published on GitHub by researcher
2026-05-08: advisory: CVE-2026-8138 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.