Armis Logo< Back

CVE-2026-5684:

A stack-based buffer overflow vulnerability in Tenda CX12L firmware 16.03.53.12 allows adjacent network attackers with low privileges to execute arbitrary code via manipulation of the `page` argument in the `fromwebExcptypemanFilter` function.


Score
Info
A numerical rating that indicates how dangerous this vulnerability is.

8.0High
  • Published Date:Apr 6, 2026
  • CISA KEV Date:*No Data*
  • Industries Affected:20

Threat Predictions

  • EPSS Score:0.1
  • EPSS Percentile:16%

Exploitability

  • Score:2.1
  • Attack Vector:ADJACENT_NETWORK
  • Attack Complexity:LOW
  • Privileges Required:LOW
  • User Interaction:NONE
  • Scope:UNCHANGED

Impact

  • Score:5.9
  • Confidentiality Impact:HIGH
  • Integrity Impact:HIGH
  • Availability Impact:HIGH

Description Preview

A stack-based buffer overflow vulnerability in Tenda CX12L firmware 16.03.53.12 allows adjacent network attackers with low privileges to execute arbitrary code via manipulation of the `page` argument in the `fromwebExcptypemanFilter` function.

Overview

CVE-2026-5684 affects the Tenda CX12L router (firmware version 16.03.53.12) and is classified as a stack-based buffer overflow in the `fromwebExcptypemanFilter` function at the `/goform/webExcptypemanFilter` endpoint. The flaw arises from improper memory boundary enforcement when processing the `page` parameter, allowing a locally adjacent, low-privileged attacker to overflow the stack buffer. The impact is severe, as exploitation can yield full control over the device with high confidentiality, integrity, and availability impact to the vulnerable component. A public proof-of-concept exploit is available, which materially elevates exploitation risk for devices exposed on local networks.

Remediation

  • At the time of publication, no official vendor patch has been referenced for this vulnerability. Users and administrators of the Tenda CX12L running firmware 16.03.53.12 are advised to take the following mitigating actions until a patch is available: restrict local network access to the device's administrative interface, enforce strict network segmentation to limit adjacency exposure, disable remote management features where not required, monitor network traffic to and from the device for anomalous activity, and check Tenda's official website (https://www.tenda.com.cn/) regularly for firmware updates or security advisories addressing this issue.

References

Industries Affected

Below is a list of industries most commonly impacted or potentially at risk based on intelligence.

Low
Mining icon
Mining
Utilities icon
Utilities
Information icon
Information
Construction icon
Construction
Retail Trade icon
Retail Trade
Manufacturing icon
Manufacturing
Wholesale Trade icon
Wholesale Trade
Educational Services icon
Educational Services
Finance and Insurance icon
Finance and Insurance
Public Administration icon
Public Administration
Real Estate Rental and Leasing icon
Real Estate Rental and Leasing
Transportation and Warehousing icon
Transportation and Warehousing
Accommodation and Food Services icon
Accommodation and Food Services
Health Care and Social Assistance icon
Health Care and Social Assistance
Arts, Entertainment, and Recreation icon
Arts, Entertainment, and Recreation
Management of Companies and Enterprises icon
Management of Companies and Enterprises
Agriculture, Forestry, Fishing and Hunting icon
Agriculture, Forestry, Fishing and Hunting
Other Services (except Public Administration) icon
Other Services (except Public Administration)
Professional, Scientific, and Technical Services icon
Professional, Scientific, and Technical Services
Administrative and Support and Waste Management and Remediation Services icon
Administrative and Support and Waste Management and Remediation Services

Focus on What Matters

See everything.Identify true risk.Proactively mitigate threats.Book a Demo

Let's talk!