CVE-2026-5687
Published: 06 April 2026
Summary
CVE-2026-5687 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Com (inferred from references). Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-5687 is a stack-based buffer overflow vulnerability in the Tenda CX12L router running firmware version 16.03.53.12. The issue resides in the fromNatStaticSetting function within the /goform/NatStaticSetting endpoint, where manipulation of the "page" argument triggers the overflow. Associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.
The vulnerability is remotely exploitable over the network with low complexity and requires only low privileges, such as those of an authenticated user, with no user interaction needed. Successful exploitation could grant attackers high-impact confidentiality, integrity, and availability consequences, potentially leading to full router compromise, arbitrary code execution, or denial of service. A public exploit is available, increasing the risk of real-world attacks against exposed Tenda CX12L devices.
Advisories and further details are documented on VulDB (vuln/355514 and related pages) and a GitHub issue at github.com/cve-a/lvdan/issues/5, with the vendor site at tenda.com.cn potentially providing patch information or updates. No specific mitigation steps are detailed in the core CVE description.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19545
Vulnerability details
A weakness has been identified in Tenda CX12L 16.03.53.12. This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. This manipulation of the argument page causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made…
more
available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack-based buffer overflow in the router's web interface endpoint (/goform/NatStaticSetting) directly enables remote exploitation of a public-facing application (T1190) with low privileges, resulting in arbitrary code execution that can be leveraged via Unix shell (T1059.004) on the Linux-based firmware.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation through firmware patching directly eliminates the stack-based buffer overflow in the fromNatStaticSetting function of Tenda CX12L firmware 16.03.53.12.
Information input validation on the 'page' argument in the /goform/NatStaticSetting endpoint prevents the manipulation that triggers the buffer overflow.
Vulnerability monitoring and scanning identifies the publicly disclosed CVE-2026-5687 in exposed Tenda CX12L routers, enabling proactive patching.