This vulnerability involves a stack-based buffer overflow in the Tenda CX12L router firmware (version 16.03.53.12), specifically in the formSetPPTPServer function of the /goform/SetPptpServerCfg endpoint. An attacker can remotely trigger this overflow, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Exploit code is publicly available, but no official patch or vendor advisory has been released.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. Since the exploit is publicly known, the risk of exploitation is elevated despite no confirmed reports of in-the-wild attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, disabling PPTP server functionality if not required, or applying network-level protections to restrict access to the vulnerable endpoint. Monitor vendor communications for updates on patches or official mitigations.