CVE-2026-13515

Name of the Vulnerable Software and Affected Versions Tenda JD12L version 16.03.53.23

Description A stack-based buffer overflow occurs in the formSetPPTPServer() function within the /goform/SetPptpServerCfg file. This issue is triggered by the manipulation of the startIp argument, allowing a remote attacker to execute the attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /goform/SetPptpServerCfg endpoint to minimize the risk of exploitation.