CVE-2026-13518: Tenda JD12L Stack Buffer Overflow in NAT Configuration (CVSS 8.8)

Technical summary

CVE-2026-13518 exploits improper input validation in Tenda JD12L's `fromAddressNat` function. The vulnerable parameter `page` is not adequately bounds-checked before being written to a stack-allocated buffer, enabling a classic stack overflow. An authenticated user can overwrite the stack frame, including return addresses, to redirect execution flow. The vulnerability maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). The attack surface is remotely accessible via HTTP, requiring only network connectivity and valid credentials.

Business impact

Compromise of Tenda JD12L devices could allow attackers to pivot into internal networks, intercept or redirect traffic, or use affected routers as staging points for lateral movement. Organizations relying on these routers for branch office or remote connectivity face potential data exfiltration, network eavesdropping, and operational disruption. The availability of public exploit code substantially increases the likelihood of rapid weaponization and widespread attack campaigns.

Affected systems

Tenda JD12L firmware version 16.03.53.23 is confirmed vulnerable. Organizations should determine whether other Tenda JD12L firmware revisions or related Tenda router models are similarly affected by consulting Tenda's security advisories. The lack of publicly disclosed patch information in this record necessitates direct vendor contact to identify which firmware versions remediate the issue.

Exploitability

The vulnerability is remotely exploitable over the network but requires valid authentication credentials. This reduces the attack surface compared to unauthenticated exploits but remains dangerous in environments where default credentials exist, credentials have been compromised, or where an attacker has already gained a foothold. Public disclosure and available proof-of-concept code mean exploitation tools are or will soon be available, increasing the likelihood of active attacks. The attack requires minimal complexity and no user interaction, resulting in a CVSS v3.1 score of 8.8 (HIGH severity).

Remediation

Immediately contact Tenda support to obtain a patched firmware version for the JD12L. Tenda has not yet released official patch information in public KEV databases, so proactive outreach is essential. As an interim mitigation, restrict administrative access to the router's web interface via firewall rules, disable remote management features if not operationally required, and enforce strong, unique credentials on all network devices. Monitor for suspicious administrative activity on affected routers.

Patch guidance

Await an official firmware update from Tenda addressing CVE-2026-13518. Once available, apply the update promptly through the router's administration interface or via Tenda's firmware distribution channels. Verify the update resolves the vulnerability by checking release notes and security advisories. Given the public nature of exploit code, prioritize patching over routine maintenance windows. If no patch is available within a defined timeframe, consider replacing the device with a router from a vendor with demonstrated patch responsiveness.

Detection guidance

Network detection: Monitor for POST requests to `/goform/addressNat` with unusually large or suspicious `page` parameters, or requests containing encoded payload patterns. Host-based detection: Log and alert on any administrative authentication followed by NAT configuration changes or unexpected process spawning from the Tenda process space. Behavioral indicators include abnormal CPU spikes, memory corruption crashes, or unexpected outbound connections from the router. Configure SIEM rules to flag multiple failed authentication attempts followed by successful login and immediate NAT setting modifications.

Why prioritize this

This vulnerability merits urgent remediation due to high CVSS score (8.8), publicly available exploits, remote network accessibility, and the router's position as a network perimeter device with access to sensitive traffic. Although authentication is required, the combination of default credentials, credential reuse, and prior compromise scenarios makes exploitation likely in real-world deployments. Organizations should treat patching as critical rather than standard.

Risk score, explained

The CVSS v3.1 score of 8.8 reflects Attack Vector: Network (maximum severity), low Attack Complexity, requirement for low privilege (authenticated user), no scope change, and high confidentiality, integrity, and availability impact. The presence of public exploit code and the device's role in network infrastructure elevate practical risk above the base score. No CVSS Environmental or Temporal modifiers are provided by the vendor; organizations should apply their own multipliers based on network criticality and exposure.

Frequently asked questions