CVE-2026-13515: Tenda JD12L Stack Buffer Overflow in PPTP Server Configuration

Technical summary

CVE-2026-13515 is a stack-based buffer overflow (CWE-119, CWE-121) in the formSetPPTPServer function located at /goform/SetPptpServerCfg on Tenda JD12L firmware version 16.03.53.23. The vulnerability exists due to insufficient bounds checking on the startIp argument, allowing an authenticated remote attacker to write beyond allocated stack memory. This can lead to stack corruption, denial of service, or control flow hijacking depending on the target architecture and memory layout.

Business impact

Compromise of a Tenda JD12L router can lead to network segmentation bypass, interception of traffic, unauthorized access to connected resources, or denial of service affecting all devices on the network. For organizations relying on these devices for remote access or branch office connectivity via PPTP, exploitation could disrupt business continuity and expose sensitive traffic to eavesdropping.

Affected systems

Tenda JD12L firmware version 16.03.53.23 is confirmed affected. Organizations should verify whether this specific firmware version is deployed in their environment. Tenda has not provided a list of additional affected versions or models in the available advisory data; verify against the vendor's security bulletin for a complete compatibility matrix.

Exploitability

The vulnerability requires authentication (consistent with the CVSS vector PR:L designation), meaning an attacker must first obtain valid credentials. However, the attack is trivial to execute once authenticated—no user interaction is required and exploitation can be performed entirely remotely. Public disclosure of this vulnerability increases the likelihood of weaponization by malicious actors with internal network access or compromised credentials.

Remediation

Upgrade Tenda JD12L to a patched firmware version released after 16.03.53.23. Consult Tenda's official security advisories and firmware download page to identify the specific patched build for your model. As an interim mitigation, restrict access to the web management interface to trusted administrative networks using firewall rules or access control lists.

Patch guidance

Visit Tenda's official support portal and locate the latest firmware release for the JD12L model. Verify the version number exceeds 16.03.53.23 before deployment. Firmware updates typically require a network-accessible device and can be performed through the web interface; document any configuration backups before updating. Verify against the vendor advisory that the specific patch version addresses CVE-2026-13515.

Detection guidance

Monitor network traffic for HTTP POST requests to /goform/SetPptpServerCfg with unusually large or malformed startIp parameter values. Log access to the router's web management interface and review authentication logs for suspicious login activity, especially from unexpected source IPs. Use intrusion detection signatures targeting stack-based buffer overflows in Tenda firmware if available from your IDS vendor. Inspect router logs for any signs of application crashes or restarts correlated with configuration change attempts.

Why prioritize this

With a CVSS score of 8.8 (HIGH) and public disclosure, this vulnerability warrants urgent attention despite the authentication requirement. The combination of remote exploitability, high confidentiality/integrity/availability impact, and known public exploit code makes it attractive to adversaries with initial network access. Organizations should prioritize patching or implementing compensating controls within 7–14 days.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability (C:H/I:H/A:H), network-accessible attack vector (AV:N), and low attack complexity (AC:L). The primary limiting factor is the requirement for low-privilege authentication (PR:L), which prevents remote unauthenticated exploitation. In environments where administrative credentials are shared, weak, or compromised, this distinction erodes rapidly.

Frequently asked questions