This vulnerability involves a stack-based buffer overflow in the Tenda CX12L router firmware version 16.03.53.12, specifically in the formSetPPTPServer function within the /goform/SetPptpServerCfg endpoint. An attacker can remotely trigger this overflow, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, reflecting network attack vector, low complexity, no user interaction, and high impact on confidentiality, integrity, and availability. Although exploit code is publicly available, no confirmed exploitation in the wild has been reported. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected Tenda CX12L device. The vulnerability impacts confidentiality, integrity, and availability of the device. Given the remote attack vector and low complexity, this poses a significant risk to affected devices if left unmitigated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider disabling the PPTP server functionality if possible or restrict access to the management interface to trusted networks only to reduce exposure.