CVE-2026-15695
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A stack-based buffer overflow vulnerability has been discovered in Tenda BE12 Pro firmware version 16.03.66.23, specifically in the fromDhcpListClient function of the /goform/DhcpListClient file. An attacker can remotely exploit this flaw by manipulating the page argument, potentially leading to arbitrary code execution.
Risk Assessment
The risk to the organization is the potential for remote takeover of the network device, which could allow an attacker to intercept network traffic, modify configurations, or use the device as an entry point into the internal network.
Recommendation
It is recommended to immediately update the Tenda BE12 Pro firmware to the latest available version if a patch has been released. If no update is available, restrict access to the device's management interface to trusted networks only.
Other vulnerabilities in Tenda BE12 Pro
See all- CVE-2026-15696High
A stack-based buffer overflow vulnerability has been discovered in the Tenda BE12 Pro device running firmware version 16.03.66.23, specifically in the fromVirtualSer function of the /goform/VirtualSer file. An attacker can remotely manipulate the page argument, causing a buffer overflow. The exploit has been publicly disclosed and may be used.
- CVE-2026-15694High
A stack-based buffer overflow vulnerability was found in Tenda BE12 Pro firmware version 16.03.66.23 in the fromSetIpBind function of the /goform/SetIpBind file. An attacker can remotely exploit this by manipulating the page argument, potentially leading to arbitrary code execution.
- CVE-2026-15693High
A stack-based buffer overflow vulnerability has been detected in Tenda BE12 Pro firmware version 16.03.66.23 in the fromSafeMacFilter function of the /goform/SafeMacFilter file. An attacker can remotely exploit this by manipulating the page argument, potentially leading to arbitrary code execution. The exploit has been publicly disclosed.
- CVE-2026-15692High
A stack-based buffer overflow vulnerability has been identified in Tenda BE12 Pro firmware version 16.03.66.23, specifically in the fromSafeUrlFilter function of the /goform/SafeUrlFilter file. Manipulating the page argument allows remote exploitation. The exploit has been publicly disclosed, increasing the risk of attacks.
- CVE-2026-15691High
A stack-based buffer overflow vulnerability has been discovered in the Tenda BE12 Pro router version 16.03.66.23, specifically in the fromSafeClientFilter function of the /goform/SafeClientFilter file. An attacker can remotely manipulate the page argument to trigger the overflow. The exploit has been publicly released and may be used in attacks.
Original NVD description (English source)
A flaw has been found in Tenda BE12 Pro 16.03.66.23. The affected element is the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the argument page causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.