Tenda BE3L Pro CVE-2026-114268

Exploitation requires network access to the router's HTTP management interface and the ability to invoke /goform/WifiBasicSet with a malicious security_5g value; the supplied CVSS 4.0 vector carries PR:L, indicating a low-privilege authenticated session (e.g., a logged-in web UI user) is needed rather than fully unauthenticated access. No user interaction is required (UI:N) and attack complexity is low (AC:L). Practical exposure is limited by whether the management interface is reachable from the attacker's network position - default configurations typically expose it only on the LAN/Wi-Fi side, so remote-WAN exploitation depends on the interface being WAN-exposed. Affected scope is confined to Tenda BE3L Pro firmware 16.03.60.62.

This is a buffer overflow (CWE-120) in the Tenda BE3L Pro router firmware 16.03.60.62, in the formWifiBasicSet handler for /goform/WifiBasicSet via the security_5g parameter. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 8.6 (High) and indicates network-reachable, low-complexity exploitation requiring low-level privileges (PR:L), with high impact to confidentiality, integrity, and availability on both the vulnerable and subsequent systems. Exploit maturity is marked E:P (Proof-of-Concept), consistent with the publicly available exploit on GitHub (Tmzop/Tenda-CVE). The vulnerability is NOT listed in CISA KEV, and no EPSS score is provided in the input, so predicted exploitation probability is unknown. Real-world risk is moderated by several factors: this is VulDB-reported (a crowd/automated source) rather than vendor-confirmed, it affects a specific consumer/SOHO router model, and the PR:L requirement implies some prior access or authentication is needed. However, the combination of a published exploit, low attack complexity, and the historical pattern of Tenda /goform buffer overflows being trivially weaponizable makes this a credible priority for anyone with these devices exposed. Net: genuine actionable risk for affected deployments, but not a mass-exploitation emergency absent KEV/EPSS corroboration.

An attacker with network reachability to the router's web management interface sends a crafted request to /goform/WifiBasicSet containing an oversized security_5g argument, overflowing a fixed-size buffer in formWifiBasicSet. This corrupts memory to crash the device or potentially execute attacker-controlled code with the web server's privileges. A public proof-of-concept exploit is available on GitHub (Tmzop/Tenda-CVE), lowering the barrier to reproduction.