CVE-2026-11504: Tenda CX12L Wi-Fi Schedule Configuration Endpoint openSchedWifi setSchedWifi stack-based overflow

Synopsis

A stack-based buffer overflow affects the Tenda CX12L wireless router (firmware 16.03.53.12) in the setSchedWifi function, reachable via the /goform/openSchedWifi Wi-Fi Schedule Configuration endpoint. An attacker with a low-privilege account can send a crafted schedStartTime or schedEndTime argument over the network to overflow the stack. Successful exploitation gives the attacker full control over the device, including the ability to read sensitive data, tamper with configuration, or crash the service. No fix version has been published; HarborGuard tracks this advisory and will make a patched rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the device's HTTP service remotely.

• AuthenticationRequired

  The attack requires a low-privilege account; any valid user credential on the device is sufficient to reach the vulnerable endpoint.

• Victim interactionNot required

  No action from a logged-in user or administrator is needed; the attacker triggers the overflow directly by sending a crafted request.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental preconditions.

Blast Radius

• A successful attacker gains the ability to execute arbitrary code on the router, taking full control of the device.
• Confidential data stored or processed by the device, including Wi-Fi credentials and network configuration, is exposed to the attacker.
• The attacker can modify router settings, redirect traffic, or disable network controls, tampering with the device's intended behavior.
• The overflow can crash the affected service or the device entirely, disrupting network connectivity for all clients on the segment.