PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-13516 Tenda CVE debrief

CVE-2026-13516 is a stack-based buffer overflow vulnerability detected in Tenda JD12L 16.03.53.23. The affected element is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet. Performing a manipulation of the argument shareSpeed results in the vulnerability. The attack may be initiated remotely. The exploit is now public and may be used. This vulnerability has a CVSS score of 7.4 and a severity of HIGH.

Vendor
Tenda
Product
JD12L
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-29
Original CVE updated
2026-06-29
Advisory published
2026-06-29
Advisory updated
2026-06-29

Who should care

Security teams and administrators responsible for Tenda JD12L 16.03.53.23 devices should be aware of this vulnerability. The vulnerability's remote attack vector and public exploit availability make it a priority for patching. Organizations using affected devices should assess their inventory and apply patches or mitigations.

Technical summary

The vulnerability is a stack-based buffer overflow in the fromSetWifiGusetBasic function of /goform/WifiGuestSet in Tenda JD12L 16.03.53.23. The vulnerability is triggered by manipulating the shareSpeed argument. The CVSS:4.0 vector is AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. The weakness is primarily classified as CWE-119 and CWE-121.

Defensive priority

High priority due to remote attack vector and public exploit availability. Apply patches or mitigations as soon as possible.

Recommended defensive actions

  • Apply patches or updates provided by the vendor.
  • Conduct a thorough inventory of affected devices.
  • Implement compensating controls, such as network segmentation or access restrictions.
  • Monitor for suspicious activity related to the vulnerability.
  • Consider vulnerability scanning to identify exposed devices.

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. Additional sources, including Vuldb and GitHub, offer further context and potential exploit details. However, due to the limited information available, defenders should focus on patching and inventory management.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-13516 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-13516

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-13516 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-13516

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.