CVE-2026-5683
Published: 06 April 2026
Summary
CVE-2026-5683 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Cx12L Firmware. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the stack-based buffer overflow flaw in the fromP2pListFilter function by identifying, reporting, and applying patches or updates to the affected Tenda CX12L firmware.
Requires validation of the 'page' argument input to the /goform/P2pListFilter endpoint to ensure it matches expected format and bounds, preventing the buffer overflow manipulation.
Deploys memory protection mechanisms such as stack canaries or address space layout randomization to detect and prevent exploitation of the stack-based buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in router web form handler (/goform/P2pListFilter) directly enables exploitation of a network-accessible application via crafted input to the 'page' parameter.
NVD Description
A vulnerability was found in Tenda CX12L 16.03.53.12. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack must originate from the local network.…
more
The exploit has been made public and could be used.
Deeper analysisAI
CVE-2026-5683 is a stack-based buffer overflow vulnerability affecting the Tenda CX12L router on firmware version 16.03.53.12. The flaw resides in the fromP2pListFilter function within the /goform/P2pListFilter file, where manipulation of the "page" argument triggers the overflow.
Exploitation requires an attacker with local network access (AV:A) and low privileges (PR:L), with low attack complexity and no user interaction needed (UI:N). Successful attacks can result in limited impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), earning a CVSS v3.1 base score of 5.5. The exploit has been publicly disclosed and could be used.
Advisories referenced in VulDB entries (vuln/355510) and a GitHub issue detail the vulnerability, including CTI information. The Tenda manufacturer's site (tenda.com.cn) is listed, though no specific patches or mitigations are detailed in the provided references.
Details
- CWE(s)