Which versions of Tenda BE12 Pro are affected by CVE-2026-15694?

Tenda BE12 Pro routers running firmware 16.03.66.23 contain a remotely exploitable stack buffer overflow in the SetIpBind endpoint that enables unauthenticated network-adjacent attackers to execute…

Is there a public PoC exploit available for CVE-2026-15694?

Yes, a public proof-of-concept exploit is available for CVE-2026-15694. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2026-15694?

Within 24 hours, audit all network inventory to identify and document Tenda BE12 Pro routers currently deployed, with specific attention to those running firmware version 16.03.66.23. Within 7 days, isolate affected devices on a restricted network segment with firewall rules blocking unnecessary inbound connections, disable remote management access where operationally feasible, and enable detailed event logging and alerting for these devices. Within 30 days, execute a device replacement strategy or contact Tenda to confirm patch release timelines; evaluate alternative router platforms with active vendor support; document all interim controls implemented and establish a quarterly review cycle until remediation is complete.

Tenda BE12 Pro CVE-2026-15694

Q: What is the CVSS score of CVE-2026-15694?

CVE-2026-15694 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-43680 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-14 VulDB

GHSA-r3cq-fh59-3m7p

Tenda Buffer Overflow Stack Overflow Be12 Pro

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable goform endpoint with low complexity, but the management interface requires low-privilege authentication (PR:L); memory-corruption RCE yields full C/I/A impact on the device.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 15:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 15:22 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Jul 14, 2026 - 14:45 vuln.today

CVE Published

Jul 14, 2026 - 14:15 cve.org

HIGH 8.7

DescriptionCVE.org

A vulnerability was detected in Tenda BE12 Pro 16.03.66.23. Impacted is the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.

AnalysisAI

Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) lets attackers corrupt memory by manipulating the 'page' argument passed to the fromSetIpBind function of the /goform/SetIpBind endpoint. The flaw is remotely reachable over the network and, per the CVSS 4.0 vector, requires low-level privileges (PR:L) while yielding high confidentiality, integrity, and availability impact - typically resulting in device crash or arbitrary code execution on the router. Publicly available exploit code exists (E:P), disclosed via VulDB, though it is not listed in CISA KEV.

Technical ContextAI

The affected component is the web management interface of Tenda's BE12 Pro, a consumer/SOHO Wi‑Fi router. Tenda routers expose configuration handlers under the /goform/ URI namespace; here the fromSetIpBind handler (which processes IP/MAC binding configuration) copies the attacker-supplied 'page' parameter into a fixed-size stack buffer without bounds checking. This is a classic CWE‑121 Stack-Based Buffer Overflow: oversized input overruns the buffer and overwrites adjacent stack memory including saved registers/return address. Because these embedded MIPS/ARM Linux firmware images frequently lack modern exploit mitigations (stack canaries, ASLR, non-executable stack are often absent or weak), such overflows are commonly escalatable from a crash to full control of the httpd/goform process. The CPE cpe:2.3:a:tenda:be12_pro:*:*:*:*:*:*:*:* identifies the product but does not pin a fixed version boundary; the description specifies firmware 16.03.66.23.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published a fixed firmware version in the provided data, so monitor https://www.tenda.com.cn/ for a firmware update superseding 16.03.66.23 and apply it once released. As compensating controls, restrict access to the router's web management interface: disable remote/WAN-side administration so /goform/SetIpBind is unreachable from the internet, and limit LAN management to trusted hosts or a management VLAN (trade-off: reduces convenience of remote config). Change default administrator credentials and enforce strong passwords, since exploitation requires low privileges (PR:L) and weak/default logins make that trivial. Where feasible, place the device behind a firewall that blocks inbound access to the HTTP management port from untrusted networks. Track the disclosure at https://vuldb.com/cve/CVE-2026-15694 for an updated fix version.