Which versions of Tenda BE12 Pro are affected by CVE-2026-15693?

Tenda BE12 Pro routers running firmware version 16.03.66.23 contain a remotely exploitable buffer overflow (CVE-2026-15693) with publicly available exploit code that can crash the device or enable…

Is there a public PoC exploit available for CVE-2026-15693?

Yes, a public proof-of-concept exploit is available for CVE-2026-15693. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-15693?

Within 24 hours, inventory all Tenda BE12 Pro routers in production and document firmware versions; restrict access to router management interfaces (HTTP/HTTPS) to authorized administrative networks only using firewall rules. Within 7 days, monitor Tenda security advisories for patch releases, implement network segmentation to isolate affected routers from sensitive infrastructure, and deploy any available IDS/IPS signatures for CVE-2026-15693. Within 30 days, develop and begin executing a hardware replacement plan using alternative vendors with active security support; prioritize replacement of routers in external-facing or DMZ deployments, and escalate timeline if Tenda does not release patches within 60 days.

Tenda BE12 Pro CVE-2026-15693

Q: What is the CVSS score of CVE-2026-15693?

CVE-2026-15693 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-43677 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-14 VulDB

GHSA-5w66-g5mr-5v9h

Tenda Buffer Overflow Stack Overflow Be12 Pro

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable low-complexity overflow needing a low-privilege web-admin session (PR:L); memory-corruption on the device gives high C/I/A with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 14:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 14:22 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Jul 14, 2026 - 14:15 vuln.today

CVE Published

Jul 14, 2026 - 13:15 cve.org

HIGH 8.7

DescriptionCVE.org

A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23. This issue affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) lets remote attackers corrupt memory by manipulating the 'page' argument of the fromSafeMacFilter handler at /goform/SafeMacFilter. Publicly available exploit code exists, though there is no public exploit identified as being used in active campaigns and it is not listed in CISA KEV. Successful exploitation can crash the device or potentially achieve code execution on the router's embedded OS. EPSS data was not provided.

Technical ContextAI

The affected component is the web-management HTTP interface of a consumer/SOHO Tenda BE12 Pro router. The vulnerable code path is the fromSafeMacFilter function serving the /goform/SafeMacFilter endpoint, which implements the MAC-address safe/allow-list filter feature. The 'page' request parameter is copied into a fixed-size stack buffer without adequate bounds checking, matching CWE-121 (Stack-based Buffer Overflow). Tenda's SOHO firmware is built on embedded Linux with lightweight goform CGI-style handlers written in C, where unchecked strcpy/sprintf-style operations into local stack arrays are a recurring pattern; overflowing the buffer overwrites the saved return address and adjacent stack data, giving an attacker control over execution flow on a MIPS/ARM embedded target. The single affected product per the CPE is cpe:2.3:a:tenda:be12_pro:*:*:*:*:*:*:*:* (firmware 16.03.66.23 named in the description).

RemediationAI

No vendor-released patch identified at time of analysis - no fixed firmware version is cited in the source data, so monitor Tenda (https://www.tenda.com.cn/) and the VulDB entry (https://vuldb.com/vuln/378240) for an updated build and apply it once released. As compensating controls: disable remote/WAN web management so the /goform/SafeMacFilter endpoint is not reachable from the internet (trade-off: loss of remote administration convenience); restrict access to the router's HTTP management interface to a trusted management VLAN or specific admin hosts via ACL (trade-off: administrative overhead); change default administrator credentials and avoid sharing the low-privilege account exploitation depends on, since the CVSS vector requires PR:L (trade-off: none significant); and if the SafeMacFilter/MAC-filter feature is unused, avoid exposing that configuration page and consider network segmentation to limit which clients can reach the admin UI. Reboot/monitoring procedures should be in place because a failed exploit attempt will likely crash the device.