Cyber Resilience

CVE-2026-5683

LowPublic PoC

Published: 06 April 2026

Published
06 April 2026
Modified
30 April 2026
KEV Added
Patch
CVSS Score v4 2.0 CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0002 6.6th percentile
Risk Priority 4 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5683 is a low-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Cx12L Firmware. Its CVSS base score is 2.0 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2026-5683 is a stack-based buffer overflow vulnerability affecting the Tenda CX12L router on firmware version 16.03.53.12. The flaw resides in the fromP2pListFilter function within the /goform/P2pListFilter file, where manipulation of the "page" argument triggers the overflow.

Exploitation requires an attacker with local network access (AV:A) and low privileges (PR:L), with low attack complexity and no user interaction needed (UI:N). Successful attacks can result in limited impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), earning a CVSS v3.1 base score of 5.5. The exploit has been publicly disclosed and could be used.

Advisories referenced in VulDB entries (vuln/355510) and a GitHub issue detail the vulnerability, including CTI information. The Tenda manufacturer's site (tenda.com.cn) is listed, though no specific patches or mitigations are detailed in the provided references.

EU & UK References

Vulnerability details

A vulnerability was found in Tenda CX12L 16.03.53.12. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack must originate from the local network.…

more

The exploit has been made public and could be used.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Stack-based buffer overflow in router web form handler (/goform/P2pListFilter) directly enables exploitation of a network-accessible application via crafted input to the 'page' parameter.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-8138Same product: Tenda Cx12L
CVE-2026-5684Same product: Tenda Cx12L
CVE-2025-7417Same vendor: Tenda
CVE-2025-9046Same vendor: Tenda
CVE-2026-2877Same vendor: Tenda
CVE-2025-11122Same vendor: Tenda
CVE-2025-8060Same vendor: Tenda
CVE-2025-8017Same vendor: Tenda
CVE-2025-7531Same vendor: Tenda
CVE-2026-5989Same vendor: Tenda

Affected Assets

tenda
cx12l firmware
16.03.53.12

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly remediates the stack-based buffer overflow flaw in the fromP2pListFilter function by identifying, reporting, and applying patches or updates to the affected Tenda CX12L firmware.

prevent

Requires validation of the 'page' argument input to the /goform/P2pListFilter endpoint to ensure it matches expected format and bounds, preventing the buffer overflow manipulation.

prevent

Deploys memory protection mechanisms such as stack canaries or address space layout randomization to detect and prevent exploitation of the stack-based buffer overflow.

References