CVE-2026-5684:

A stack-based buffer overflow vulnerability in Tenda CX12L firmware 16.03.53.12 allows adjacent network attackers with low privileges to execute arbitrary code via manipulation of the `page` argument in the `fromwebExcptypemanFilter` function.

CVE-2026-5684 affects the Tenda CX12L router (firmware version 16.03.53.12) and is classified as a stack-based buffer overflow in the `fromwebExcptypemanFilter` function at the `/goform/webExcptypemanFilter` endpoint. The flaw arises from improper memory boundary enforcement when processing the `page` parameter, allowing a locally adjacent, low-privileged attacker to overflow the stack buffer. The impact is severe, as exploitation can yield full control over the device with high confidentiality, integrity, and availability impact to the vulnerable component. A public proof-of-concept exploit is available, which materially elevates exploitation risk for devices exposed on local networks.