Cyber Resilience

CVE-2026-5685

High

Published: 06 April 2026

Published
06 April 2026
Modified
07 April 2026
KEV Added
Patch
CVSS Score v4 7.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0069 48.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-5685 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Com (inferred from references). Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2026-5685 is a stack-based buffer overflow vulnerability affecting the Tenda CX12L router on firmware version 16.03.53.12. The issue resides in the fromAddressNat function within the /goform/addressNat file, where manipulation of the "page" argument triggers the overflow. Published on 2026-04-06, it is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).

The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity. Exploitation requires low privileges (PR:L) and can be performed remotely over the network with low complexity and no user interaction. Successful attacks could grant attackers high-impact control, compromising confidentiality, integrity, and availability of the affected device.

Advisories and further details are documented on VulDB (including vuln/355512 and related CTI), a GitHub issue at cve-a/lvdan/issues/3, and the Tenda website. The vendor's site at tenda.com.cn should be consulted for any patches or mitigation guidance, as no specific remediation steps are detailed in the core vulnerability description.

Notable context includes a publicly available exploit, which increases the risk of real-world exploitation attempts against unpatched Tenda CX12L devices.

EU & UK References

Vulnerability details

A vulnerability was identified in Tenda CX12L 16.03.53.12. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and…

more

might be used.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Remote stack-based buffer overflow in router web interface (/goform/addressNat) with public exploit directly enables exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-9428Shared CWE-119, CWE-121
CVE-2026-2886Shared CWE-119, CWE-121
CVE-2025-8017Shared CWE-119, CWE-121
CVE-2025-8816Shared CWE-119, CWE-121
CVE-2025-14665Shared CWE-119, CWE-121
CVE-2025-9247Shared CWE-119, CWE-121
CVE-2026-5604Shared CWE-119, CWE-121
CVE-2025-8824Shared CWE-119, CWE-121
CVE-2025-11386Shared CWE-119, CWE-121
CVE-2025-15190Shared CWE-119, CWE-121

Affected Assets

Com
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly remediates the stack-based buffer overflow vulnerability by requiring timely identification, reporting, and correction of the flaw in the Tenda CX12L firmware.

prevent

Prevents exploitation of the buffer overflow by enforcing validation of the manipulated 'page' argument in the /goform/addressNat endpoint.

prevent

Mitigates stack-based buffer overflow exploitation through memory protections such as stack canaries, ASLR, or DEP to block unauthorized code execution.

References