CVE-2026-5684
Published: 06 April 2026
Summary
CVE-2026-5684 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Cx12L Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 39.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the stack-based buffer overflow vulnerability by requiring timely firmware updates or patches for the affected Tenda CX12L router.
Prevents exploitation of the buffer overflow by enforcing validation of the manipulable 'page' argument in the fromwebExcptypemanFilter function.
Mitigates stack-based buffer overflow exploitation through memory protections such as stack canaries, non-executable stacks, and address space randomization.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in router web interface handler requires low privileges on local network and enables privilege escalation to full compromise (T1068) plus exploitation of the remote web service (T1210).
NVD Description
A vulnerability was determined in Tenda CX12L 16.03.53.12. Affected by this issue is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack requires access to the local…
more
network. The exploit has been publicly disclosed and may be utilized.
Deeper analysisAI
CVE-2026-5684 is a stack-based buffer overflow vulnerability affecting the Tenda CX12L router on firmware version 16.03.53.12. The flaw resides in the fromwebExcptypemanFilter function within the /goform/webExcptypemanFilter file, where manipulation of the "page" argument triggers the overflow. This issue is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), with a CVSS v3.1 base score of 8.0.
Attackers with access to the local network can exploit this vulnerability if they possess low privileges, requiring no user interaction. Successful exploitation enables high-impact consequences, including unauthorized disclosure of sensitive data, modification of system resources, and denial of service, potentially leading to full compromise of the device. An exploit has been publicly disclosed and may be utilized by adversaries.
Advisories on VulDB (vuln/355511 and related CTI) and the GitHub repository (cve-a/lvdan/issues/2) provide further details on the vulnerability. Practitioners should check the vendor site at tenda.com.cn for any available patches or firmware updates to mitigate the issue.
Details
- CWE(s)