CVE-2026-5686
Published: 06 April 2026
Summary
CVE-2026-5686 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Com (inferred from references). Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-5686 is a stack-based buffer overflow vulnerability affecting the Tenda CX12L router on firmware version 16.03.53.12. The flaw resides in the fromRouteStatic function of the /goform/RouteStatic file, where manipulation of the "page" argument triggers the overflow. Published on 2026-04-06, it is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), enabling remote exploitation over the network with low attack complexity. It requires low privileges, such as those held by an authenticated user, and no user interaction. Attackers can achieve high impacts on confidentiality, integrity, and availability, potentially leading to full device compromise.
Advisories from VulDB (https://vuldb.com/vuln/355513, https://vuldb.com/vuln/355513/cti) and a related GitHub issue (https://github.com/cve-a/lvdan/issues/4) document the issue, while the Tenda website (https://www.tenda.com.cn/) may provide further guidance. An exploit has been publicly released and may be used in attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19543
Vulnerability details
A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit has…
more
been released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The remote stack-based buffer overflow in the authenticated web interface (/goform/RouteStatic) of a publicly accessible router directly enables exploitation of a public-facing application for initial access and full device compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and correction of flaws like this stack-based buffer overflow via firmware patching or updates.
SI-10 mandates validation of inputs such as the 'page' argument to prevent manipulation leading to buffer overflows in the /goform/RouteStatic function.
SI-16 implements memory protections like stack canaries and ASLR to mitigate exploitation of stack-based buffer overflows.