CVE-2026-5609
Published: 06 April 2026
Summary
CVE-2026-5609 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda I12 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-5609 is a stack-based buffer overflow vulnerability affecting the Tenda i12 router on firmware version 1.0.0.11(3862). The issue lies in the formwrlSSIDset function of the /goform/wifiSSIDset file within the Parameter Handler component, where manipulation of the index/wl_radio argument triggers the overflow. It is remotely exploitable and associated with CWE-119 and CWE-121, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and without requiring user interaction. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially leading to arbitrary code execution or system crashes via the buffer overflow.
Advisories referenced in VulDB entries (vuln/355400 and related pages) document the flaw and its exploitability, while a GitHub repository provides a published proof-of-concept exploit. The vendor's site at tenda.com.cn is listed, but no specific patches or mitigation guidance is detailed in the available references.
An exploit has been publicly released, heightening the risk of real-world attacks against unpatched Tenda i12 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19148
Vulnerability details
A flaw has been found in Tenda i12 1.0.0.11(3862). Affected by this vulnerability is the function formwrlSSIDset of the file /goform/wifiSSIDset of the component Parameter Handler. This manipulation of the argument index/wl_radio causes stack-based buffer overflow. It is possible to…
more
initiate the attack remotely. The exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remotely exploitable stack-based buffer overflow in the public-facing web interface (/goform/wifiSSIDset) of the Tenda router, directly enabling T1190 (Exploit Public-Facing Application) for initial access and arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates the index/wl_radio parameter input to prevent stack-based buffer overflow exploitation in the formwrlSSIDset function.
Requires identification, reporting, and correction of the specific buffer overflow flaw in the Tenda i12 firmware via patching or updates.
Implements runtime memory protections like stack canaries or guard pages to mitigate stack buffer overflow attempts leading to arbitrary code execution.