CVE-2026-13515 is a stack-based buffer overflow vulnerability affecting Tenda JD12L firmware version 16.03.53.23. The flaw is triggered by specially crafted input to the startIp parameter in the formSetPPTPServer function of the /goform/SetPptpServerCfg endpoint. This vulnerability allows remote attackers to potentially execute arbitrary code or cause a denial of service due to memory corruption. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high impact with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed but no official patch or vendor advisory is available at this time.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected device. The attacker can trigger a stack-based buffer overflow remotely by manipulating the startIp argument, potentially compromising the device's integrity and availability. The vulnerability requires no user interaction and low privileges, increasing the risk of exploitation. However, no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the affected device's management interface to trusted sources only and monitor for unusual activity related to the /goform/SetPptpServerCfg endpoint. Avoid exposing the device management interface to untrusted networks.