EUVD-2026-43661
GHSA-53h5-qcmx-8q3x
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 14, 2026
Stack-based buffer overflow in the Tenda BE12 Pro (firmware 16.03.66.23) web management interface lets an attacker corrupt memory by supplying an oversized 'page' argument to the fromSafeClientFilter handler at /goform/SafeClientFilter, potentially crashing the device or executing arbitrary code with router privileges. Per the CVSS 4.0 vector the flaw is network-reachable but requires low-level privileges (PR:L). Publicly available exploit code exists (disclosed via VulDB), but there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.
Earlier versions of this analysis (1)
Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) lets attackers corrupt memory via the fromSafeClientFilter handler by manipulating the 'page' argument sent to /goform/SafeClientFilter. The flaw is remotely reachable over the network and, per the CVSS 4.0 vector (PR:L), requires low-level authentication; publicly available exploit code exists, though no public exploit-in-the-wild campaign is confirmed. Successful exploitation can crash the device or potentially execute attacker-controlled code with high impact to confidentiality, integrity, and availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Be12 Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint (AV:N/AC:L) but requires low-privilege authentication to the UI (PR:L); memory corruption yields potential code execution with high C/I/A and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Executive ViewAI
Tenda BE12 Pro routers running firmware 16.03.66.23 are vulnerable to remote code execution through the management interface, allowing authenticated users with low privileges to gain full administrative access; publicly available exploit code creates material risk of network device compromise for affected organizations.
Within 24 hours: Identify all Tenda BE12 Pro devices in your environment and document their firmware versions; immediately restrict web management interface access (ports 80/443) to authorized administrators via firewall rules and disable remote management if operationally feasible. Within 7 days: Place affected routers on isolated management networks requiring jump-host access; contact Tenda Support to request explicit patch ETA and severity classification; document a device replacement or firmware upgrade timeline if no patch is available. Within 30 days: Deploy vendor patch to all affected devices immediately upon release; if no patch is published by day 30, execute planned hardware replacement to eliminate the vulnerability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict management interface access to trusted IP addresses using firewall ACLs; (2) disable unnecessary management protocols and require HTTPS-only administration; (3) implement separate management VLANs with jump-host access controls; (4) enable detailed authentication and system logging on affected devices; (5) monitor management logs for suspicious activity and unauthorized access attempts; (6) isolate affected routers network-architecturally to limit blast radius if compromised; (7) maintain subscription to Tenda security advisories and monitor CVE databases for patch notifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) allows remote attackers to corrupt memor
Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) lets an attacker corrupt the stack
Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) lets attackers corrupt memory by manipul
Stack-based buffer overflow in the Tenda BE12 Pro router firmware 16.03.66.23 lets an authenticated remote attacker corr
Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) lets remote attackers corrupt memo
Exploit-DB