CVE-2026-5684

CVE-2026-5684 is a stack-based buffer overflow vulnerability affecting the Tenda CX12L router running firmware version 16.03.53.12. The flaw exists in the webExcptypemanFilter function within the /goform/webExcptypemanFilter endpoint and can be triggered through manipulation of the page parameter. This vulnerability has been publicly disclosed and affects a commonly deployed consumer networking device. The vulnerability carries a HIGH CVSS score of 8.0, indicating significant risk with high confidentiality, integrity, and availability impacts. However, exploitation requires local network access and valid user credentials, substantially limiting the attack surface in most deployment scenarios. The attack itself is straightforward to execute, requiring no complex setup or timing. While the vulnerability has been publicly disclosed with exploit code available, it is not currently listed in CISA's Known Exploited Vulnerabilities catalog, suggesting limited active exploitation in the wild. The EPSS score of 0.0005 indicates this vulnerability ranks lower than 99.84 percent of known CVEs in terms of exploitation probability, and community attention appears minimal based on its inactive status on security tracking platforms. Organizations using affected Tenda devices should prioritize firmware updates to remediate exposure.