Which versions of Tenda BE12 Pro are affected by CVE-2026-15692?

A high-severity stack-based buffer overflow in Tenda BE12 Pro routers (firmware 16.03.66.23) allows low-privilege authenticated users to corrupt device memory and compromise the confidentiality,…

Is there a public PoC exploit available for CVE-2026-15692?

Yes, a public proof-of-concept exploit is available for CVE-2026-15692. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2026-15692?

Within 24 hours, restrict administrative access to affected Tenda BE12 Pro routers to trusted internal IP ranges only and audit recent authentication logs for anomalous activity. Within 7 days, identify all instances of firmware 16.03.66.23 deployed on your network and isolate those devices from critical infrastructure using firewall rules. Within 30 days, contact Tenda for patch timeline or plan a phased replacement strategy; if no update becomes available, evaluate alternative router models from vendors with active security update programs.

Tenda BE12 Pro CVE-2026-15692

Q: What is the CVSS score of CVE-2026-15692?

CVE-2026-15692 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-43667 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-14 VulDB

GHSA-cxw3-26xc-7ppc

Tenda Buffer Overflow Stack Overflow Be12 Pro

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Remotely reachable web endpoint (AV:N/AC:L) requiring a low-privilege authenticated session (PR:L), no user interaction; root-level httpd overflow yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 13:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 13:22 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Jul 14, 2026 - 13:00 vuln.today

CVE Published

Jul 14, 2026 - 12:30 cve.org

HIGH 8.7

DescriptionCVE.org

A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Stack-based buffer overflow in the Tenda BE12 Pro router firmware 16.03.66.23 lets an authenticated remote attacker corrupt memory via the fromSafeUrlFilter handler at /goform/SafeUrlFilter by supplying an oversized 'page' parameter. Publicly available exploit code exists (published via VulDB), though the flaw is not listed in CISA KEV and no active exploitation has been confirmed. The CVSS 4.0 vector (7.4, PR:L) indicates network reachability with low-privilege authentication and high impact to confidentiality, integrity, and availability of the device.

Technical ContextAI

The affected component is the web management interface of Tenda's BE12 Pro, a consumer WiFi-7 SOHO router. Tenda routers expose administrative actions through /goform/ endpoints handled by C functions in the embedded HTTP daemon (httpd); here the fromSafeUrlFilter function processes a URL-filtering (SafeUrl) configuration request. The root cause is CWE-121 (Stack-based Buffer Overflow): the 'page' argument is copied into a fixed-size stack buffer without bounds checking, so an overlong value overwrites the saved return address and adjacent stack data. Because these MIPS/ARM firmware binaries typically run the web server as root and frequently lack stack canaries, ASLR, or NX enforcement, such overflows are often directly exploitable for control-flow hijacking or at minimum a denial of service. The single affected CPE is cpe:2.3:a:tenda:be12_pro:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch identified at time of analysis - the references point only to the VulDB disclosure and a public GitHub PoC, not a fixed firmware release, so no exact fix version can be cited. As compensating controls, restrict access to the router's web management interface to trusted LAN hosts only and ensure remote/WAN-side administration is disabled (this blocks the AV:N vector from the internet at the cost of losing remote management), place management behind a VPN or dedicated management VLAN, and change any default or weak administrator credentials to blunt the PR:L requirement and reduce the chance of an attacker obtaining the low-privilege session the exploit needs. Monitor https://www.tenda.com.cn/ and the VulDB entry (https://vuldb.com/cve/CVE-2026-15692) for updated firmware and apply it once released; if the device is end-of-support, plan replacement, as consumer routers frequently receive no fix.