CVE-2026-15692
HighCVSS 8.8Summary
A stack-based buffer overflow vulnerability has been identified in Tenda BE12 Pro firmware version 16.03.66.23, specifically in the fromSafeUrlFilter function of the /goform/SafeUrlFilter file. Manipulating the page argument allows remote exploitation. The exploit has been publicly disclosed, increasing the risk of attacks.
Risk Assessment
The organization is at risk of remote code execution on the Tenda BE12 Pro device, potentially leading to network compromise, traffic interception, or further attacks on the infrastructure.
Recommendation
Immediately update the Tenda BE12 Pro firmware to the latest version if a patch is available. If not, restrict management interface access to trusted networks only.
Other vulnerabilities in Tenda BE12 Pro
See all- CVE-2026-15696High
A stack-based buffer overflow vulnerability has been discovered in the Tenda BE12 Pro device running firmware version 16.03.66.23, specifically in the fromVirtualSer function of the /goform/VirtualSer file. An attacker can remotely manipulate the page argument, causing a buffer overflow. The exploit has been publicly disclosed and may be used.
- CVE-2026-15694High
A stack-based buffer overflow vulnerability was found in Tenda BE12 Pro firmware version 16.03.66.23 in the fromSetIpBind function of the /goform/SetIpBind file. An attacker can remotely exploit this by manipulating the page argument, potentially leading to arbitrary code execution.
- CVE-2026-15693High
A stack-based buffer overflow vulnerability has been detected in Tenda BE12 Pro firmware version 16.03.66.23 in the fromSafeMacFilter function of the /goform/SafeMacFilter file. An attacker can remotely exploit this by manipulating the page argument, potentially leading to arbitrary code execution. The exploit has been publicly disclosed.
- CVE-2026-15695High
A stack-based buffer overflow vulnerability has been discovered in Tenda BE12 Pro firmware version 16.03.66.23, specifically in the fromDhcpListClient function of the /goform/DhcpListClient file. An attacker can remotely exploit this flaw by manipulating the page argument, potentially leading to arbitrary code execution.
- CVE-2026-15691High
A stack-based buffer overflow vulnerability has been discovered in the Tenda BE12 Pro router version 16.03.66.23, specifically in the fromSafeClientFilter function of the /goform/SafeClientFilter file. An attacker can remotely manipulate the page argument to trigger the overflow. The exploit has been publicly released and may be used in attacks.
Original NVD description (English source)
A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.