CVE-2026-5684

HighCVSS 8.0/10Last modified Jul 24, 2026

Description

A vulnerability was determined in Tenda CX12L 16.03.53.12. Affected by this issue is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack requires access to the local network. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Apr 6, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-568408.8PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool appro CVE-2026-568418.8A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Pr CVE-2026-568427.5A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in Un CVE-2026-568439.9Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domai CVE-2026-568448.4A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and CVE-2026-568457.5An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By CVE-2026-568467.5A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. Thi CVE-2026-568476.1A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. CVE-2026-568487.5A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is execut CVE-2026-56858.8A vulnerability was identified in Tenda CX12L 16.03.53.12. This affects the function fromAddressNat of the file /goform/addressNat. The mani CVE-2026-568504.4A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be CVE-2026-568517.5The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.