CVE-2026-11503: Tenda CX12L Wi-Fi Configuration Endpoint fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow

Synopsis

A stack-based buffer overflow exists in the Tenda CX12L router (firmware 16.03.53.12) within the Wi-Fi configuration endpoint at /goform/fast_setting_wifi_set. The vulnerability is reachable over the network by an authenticated attacker who supplies an oversized value to the ssid argument, triggering the overflow in the form_fast_setting_wifi_set function. Successful exploitation gives an attacker full read, write, and denial-of-service capability over the device. No fix version has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the device's HTTP service remotely.

• AuthenticationRequired

  The CVSS vector specifies PR:L, meaning a low-privilege authenticated account on the device is sufficient to reach the vulnerable endpoint.

• Victim interactionNot required

  No user interaction is needed; the attacker sends a crafted request directly to the endpoint without relying on any victim action.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the overflow is reliably triggered by a single malformed request with no race conditions or special environmental preconditions.

Blast Radius

• Reads arbitrary data from the device's stack memory, including credentials or session material held in process memory.
• Writes controlled data beyond the stack buffer, enabling overwrite of return addresses and likely arbitrary code execution on the router.
• Crashes the affected Wi-Fi configuration service or the entire device, disrupting network connectivity for all clients relying on the router.
• Full compromise of the device gives an attacker a persistent foothold on the local network segment served by the router.