CVE-2026-13518: Tenda JD12L Buffer Overflow Vulnerability

CVE-2026-13518 Overview

CVE-2026-13518 is a stack-based buffer overflow vulnerability in the Tenda JD12L router running firmware version 16.03.53.23. The flaw resides in the fromAddressNat function within the /goform/addressNat HTTP endpoint. An attacker can manipulate the page argument to overflow a fixed-size stack buffer. The vulnerability is remotely exploitable over the network and requires low-level privileges. Public disclosure of the exploit details has occurred, increasing the risk of active exploitation against exposed devices.

Critical Impact
Remote attackers with low privileges can corrupt stack memory in the router's HTTP service, enabling denial of service and potential arbitrary code execution on affected Tenda JD12L devices.

Affected Products

Tenda JD12L firmware version 16.03.53.23
Tenda JD12L router hardware running the vulnerable firmware
Deployments exposing the web management interface (/goform/addressNat) to untrusted networks

Discovery Timeline

2026-06-29 - CVE-2026-13518 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-13518

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). It affects the fromAddressNat handler that processes HTTP requests sent to the /goform/addressNat endpoint in the Tenda JD12L web management interface.

When the handler processes the page parameter from the incoming HTTP request, it copies attacker-supplied data into a fixed-size stack buffer without validating the input length. Supplying a page value longer than the destination buffer overwrites adjacent stack memory, including saved registers and the return address.

Successful exploitation allows an attacker to crash the HTTP service and potentially redirect execution flow on the MIPS or ARM-based embedded platform. The attack vector is network-based, and public exploit details have been referenced on VulDB and GitHub. Current EPSS data indicates a low but non-negligible probability of exploitation attempts against internet-exposed devices.

Root Cause

The root cause is the absence of bounds checking on the page argument before it is copied into a stack-allocated buffer inside fromAddressNat. The function relies on unsafe string copy semantics common to strcpy or sprintf patterns in Tenda's httpd binary. No length validation or canary-based stack protection blocks the overflow on the affected firmware build.

Attack Vector

An attacker sends a crafted HTTP request to /goform/addressNat on the router's management interface with an oversized page parameter. The request requires an authenticated session at low privilege level. Once processed by fromAddressNat, the oversized value overwrites the return address on the stack. This enables denial of service and, on firmware without stack canaries or ASLR, arbitrary code execution as the httpd process, which typically runs with root privileges on embedded routers.

Refer to the VulDB CVE-2026-13518 entry and the GitHub Issue Discussion for technical details published by the reporter.

Detection Methods for CVE-2026-13518

Indicators of Compromise

HTTP POST or GET requests to /goform/addressNat containing abnormally long values in the page parameter
Unexpected reboots or crashes of the router's httpd process visible in system logs
Outbound connections initiated from the router to unknown hosts following a suspicious HTTP request

Detection Strategies

Deploy network intrusion detection signatures that flag HTTP requests to /goform/addressNat where the page argument exceeds a reasonable length threshold (for example, 256 bytes).
Monitor router syslog output for repeated httpd restarts or segmentation fault messages indicating memory corruption attempts.
Correlate authentication events with subsequent requests to management endpoints to identify low-privilege accounts issuing anomalous payloads.

Monitoring Recommendations

Enable and forward router syslog data to a centralized log platform for retention and analysis.
Alert on any external source addresses reaching the router management interface, which should be restricted to internal networks.
Track baseline request patterns to /goform/* endpoints and generate alerts when payload sizes deviate significantly from normal administrative use.

How to Mitigate CVE-2026-13518

Immediate Actions Required

Restrict access to the router web management interface to trusted internal subnets and disable remote WAN-side administration.
Rotate all administrative credentials on affected Tenda JD12L devices, since exploitation requires low-privilege authentication.
Audit exposed devices using external scanners to confirm that /goform/addressNat is not reachable from the internet.

Patch Information

No vendor-supplied patch has been published in the referenced advisories at the time of the NVD entry. Monitor the Tenda Corporate Website and the VulDB Vulnerability #374526 record for firmware updates that address the fromAddressNat handler.

Workarounds

Disable the web management interface when not actively required for administration.
Place affected routers behind a network segmentation boundary that blocks untrusted hosts from reaching TCP ports serving the httpd service.
Replace the affected device with a supported router model if the vendor does not release a firmware fix within an acceptable window.

bash

# Configuration example: restrict management interface access via upstream firewall
# Allow only the management VLAN (192.168.10.0/24) to reach the router admin interface
iptables -A FORWARD -s 192.168.10.0/24 -d 192.168.0.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.0.1 -p tcp --dport 80 -j DROP