EUVD-2026-43667
GHSA-cxw3-26xc-7ppc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliveryAuthenticate with low-privilege/default credentials
-
ExploitPOST oversized 'page' to /goform/SafeUrlFilter
-
ExecutionOverflow stack buffer in fromSafeUrlFilter
-
PersistOverwrite saved return address
-
ImpactExecute code as root or crash httpd
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the router's HTTP management service and a low-privilege authenticated session (CVSS PR:L), then a single request to the /goform/SafeUrlFilter endpoint invoking the fromSafeUrlFilter function with an overlong 'page' parameter - this specific endpoint and parameter ARE the trigger condition. No user interaction is needed (UI:N) and complexity is low (AC:L/AT:N). Limiting factors: the management interface must be reachable (typically LAN-side unless remote/WAN administration is explicitly enabled), the attacker needs valid credentials or an active session, and only firmware 16.03.66.23 on the BE12 Pro is confirmed affected - though weak/default router credentials commonly make the PR:L barrier trivial to satisfy in practice. |
| Impact | The vendor-style CVSS 4.0 score is 7.4 (High) with AV:N/AC:L/AT:N/PR:L/UI:N and VC:H/VI:H/VA:H, meaning remote reachability, low complexity, no user interaction, but a requirement for low-level authentication (an existing session or valid credentials on the web UI). Exploit maturity is E:P (Proof-of-Concept), consistent with the publicly available PoC referenced on GitHub. This is a VulDB-sourced disclosure typical of the high-volume Tenda SOHO firmware research stream: PoC exists but there is no CISA KEV listing and no EPSS score in the provided data, so widespread automated exploitation is not evidenced. Real-world risk is meaningful for internet-exposed or LAN-adjacent devices where the management interface is reachable and credentials are weak or default, but the PR:L requirement and the niche deployment footprint temper it below a drop-everything priority. Note a common caveat for this class: many Tenda /goform overflows are reachable pre-auth in practice despite a PR:L rating, and default/weak credentials on consumer routers can effectively erase the authentication barrier - verify the true auth requirement against the device firmware. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface and holds (or obtains via default/weak credentials) a low-privilege session sends a crafted POST to /goform/SafeUrlFilter with an oversized 'page' argument, overflowing the stack buffer in fromSafeUrlFilter. This overwrites the saved return address to hijack execution as root or crash the httpd daemon, and a public proof-of-concept demonstrating the overflow is already available on GitHub. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 14, 2026
Stack-based buffer overflow in the Tenda BE12 Pro router firmware 16.03.66.23 lets an authenticated remote attacker corrupt memory via the fromSafeUrlFilter handler at /goform/SafeUrlFilter by supplying an oversized 'page' parameter. Publicly available exploit code exists (published via VulDB), though the flaw is not listed in CISA KEV and no active exploitation has been confirmed. The CVSS 4.0 vector (7.4, PR:L) indicates network reachability with low-privilege authentication and high impact to confidentiality, integrity, and availability of the device.
Earlier versions of this analysis (1)
Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) allows an authenticated remote attacker to corrupt memory by supplying an oversized 'page' parameter to the fromSafeUrlFilter handler at /goform/SafeUrlFilter, potentially achieving code execution or crashing the device. The flaw is remotely reachable over the network and, per the CVSS 4.0 vector, requires low privileges (PR:L) rather than being fully unauthenticated. Publicly available exploit code exists, and the issue carries a CVSS 4.0 base score of 8.7 (High); it is not listed in CISA KEV and no EPSS score was supplied.
RemediationAI
No vendor-released patch identified at time of analysis - the references point only to the VulDB disclosure and a public GitHub PoC, not a fixed firmware release, so no exact fix version can be cited. As compensating controls, restrict access to the router's web management interface to trusted LAN hosts only and ensure remote/WAN-side administration is disabled (this blocks the AV:N vector from the internet at the cost of losing remote management), place management behind a VPN or dedicated management VLAN, and change any default or weak administrator credentials to blunt the PR:L requirement and reduce the chance of an attacker obtaining the low-privilege session the exploit needs. Monitor https://www.tenda.com.cn/ and the VulDB entry (https://vuldb.com/cve/CVE-2026-15692) for updated firmware and apply it once released; if the device is end-of-support, plan replacement, as consumer routers frequently receive no fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the web management interface of Tenda's BE12 Pro, a consumer WiFi-7 SOHO router. Tenda routers expose administrative actions through /goform/ endpoints handled by C functions in the embedded HTTP daemon (httpd); here the fromSafeUrlFilter function processes a URL-filtering (SafeUrl) configuration request. The root cause is CWE-121 (Stack-based Buffer Overflow): the 'page' argument is copied into a fixed-size stack buffer without bounds checking, so an overlong value overwrites the saved return address and adjacent stack data. Because these MIPS/ARM firmware binaries typically run the web server as root and frequently lack stack canaries, ASLR, or NX enforcement, such overflows are often directly exploitable for control-flow hijacking or at minimum a denial of service. The single affected CPE is cpe:2.3:a:tenda:be12_pro:*:*:*:*:*:*:*:*.
Know when Be12 Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Remotely reachable web endpoint (AV:N/AC:L) requiring a low-privilege authenticated session (PR:L), no user interaction; root-level httpd overflow yields full C/I/A impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
A high-severity stack-based buffer overflow in Tenda BE12 Pro routers (firmware 16.03.66.23) allows low-privilege authenticated users to corrupt device memory and compromise the confidentiality, integrity, and availability of the network gateway. Exploit code is publicly available with no vendor patch released, creating elevated risk for organizations deploying this model.
Implement restrictive network access controls limiting administrative access to Tenda BE12 Pro routers from trusted IP ranges only; monitor network logs for exploitation attempts targeting the /goform/SafeUrlFilter endpoint; disable the SafeUrlFilter feature if operationally feasible; apply network segmentation to isolate routers from critical systems and limit blast radius of device compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) allows remote attackers to corrupt memor
Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) lets an attacker corrupt the stack
Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) lets attackers corrupt memory by manipul
Stack-based buffer overflow in the Tenda BE12 Pro (firmware 16.03.66.23) web management interface lets an attacker corru
Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) lets remote attackers corrupt memo
Exploit-DB