CVE-2026-15694
HighCVSS 8.8Summary
A stack-based buffer overflow vulnerability was found in Tenda BE12 Pro firmware version 16.03.66.23 in the fromSetIpBind function of the /goform/SetIpBind file. An attacker can remotely exploit this by manipulating the page argument, potentially leading to arbitrary code execution.
Risk Assessment
The risk for the organization includes remote takeover of the Tenda BE12 Pro device, which could compromise network integrity, intercept traffic, or be used as an entry point for further attacks.
Recommendation
It is recommended to immediately apply a firmware update from the vendor if available, or temporarily disable remote access to the management interface and restrict access to trusted IP addresses.
Other vulnerabilities in Tenda BE12 Pro
See all- CVE-2026-15696High
A stack-based buffer overflow vulnerability has been discovered in the Tenda BE12 Pro device running firmware version 16.03.66.23, specifically in the fromVirtualSer function of the /goform/VirtualSer file. An attacker can remotely manipulate the page argument, causing a buffer overflow. The exploit has been publicly disclosed and may be used.
- CVE-2026-15693High
A stack-based buffer overflow vulnerability has been detected in Tenda BE12 Pro firmware version 16.03.66.23 in the fromSafeMacFilter function of the /goform/SafeMacFilter file. An attacker can remotely exploit this by manipulating the page argument, potentially leading to arbitrary code execution. The exploit has been publicly disclosed.
- CVE-2026-15692High
A stack-based buffer overflow vulnerability has been identified in Tenda BE12 Pro firmware version 16.03.66.23, specifically in the fromSafeUrlFilter function of the /goform/SafeUrlFilter file. Manipulating the page argument allows remote exploitation. The exploit has been publicly disclosed, increasing the risk of attacks.
- CVE-2026-15695High
A stack-based buffer overflow vulnerability has been discovered in Tenda BE12 Pro firmware version 16.03.66.23, specifically in the fromDhcpListClient function of the /goform/DhcpListClient file. An attacker can remotely exploit this flaw by manipulating the page argument, potentially leading to arbitrary code execution.
- CVE-2026-15691High
A stack-based buffer overflow vulnerability has been discovered in the Tenda BE12 Pro router version 16.03.66.23, specifically in the fromSafeClientFilter function of the /goform/SafeClientFilter file. An attacker can remotely manipulate the page argument to trigger the overflow. The exploit has been publicly released and may be used in attacks.
Original NVD description (English source)
A vulnerability was detected in Tenda BE12 Pro 16.03.66.23. Impacted is the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.