A critical stack-based buffer overflow in Tenda CX12L routers allows remote, unauthenticated attackers to execute arbitrary code or crash the device.

The vulnerability exists in the fromAddressNat function within the /goform/addressNat endpoint, where the application fails to perform bounds checking on the user-controlled page parameter before copying it into a fixed-size buffer using sprintf. This flaw is remotely exploitable without authentication.

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for system compromise. Successful exploitation enables remote code execution, granting an attacker full control over the router, which can be leveraged to monitor network traffic, exfiltrate sensitive data, or pivot into internal network segments, leading to significant operational disruption and security breaches.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the device web management interface to trusted internal networks only.

Proactive Monitoring: Monitor device logs and network traffic for unusual POST requests directed at the /goform/addressNat endpoint, specifically looking for abnormally long string payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network filtering rule to inspect and block excessively long input parameters sent to the /goform/addressNat URI.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the provided technical write-up on GitHub.

Given the availability of a functional proof-of-concept and the critical nature of remote code execution, this vulnerability poses a severe risk to network integrity. Organizations utilizing the Tenda CX12L must isolate the device from external access immediately and monitor for vendor firmware updates, applying them as soon as they become available to remediate the underlying memory corruption flaw.