EUVD-2026-43686
GHSA-g3hf-vcqh-qj2p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface with low-priv access
-
DeliverySend crafted /goform/DhcpListClient request
-
ExploitOverflow 'page' argument into stack buffer
-
ExecutionOverwrite saved return address
-
PersistCrash device or execute code
-
ImpactGain control of router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to send an HTTP request with an attacker-controlled 'page' parameter to the /goform/DhcpListClient endpoint of the fromDhcpListClient handler on a Tenda BE12 Pro running firmware 16.03.66.23. Per the provided CVSS 4.0 vector the attacker needs low-privilege authentication (PR:L) to the device and no user interaction (UI:N); attack complexity is low (AC:L). The primary limiting factors are network reachability of the web management interface (by default this is LAN-only, so remote exploitation depends on WAN-side management being enabled or on the attacker having a foothold on the local network) and possession of valid low-level credentials. Only this specific model and firmware are confirmed affected. |
| Impact | Signals are mixed and should be weighted carefully. The CVSS 4.0 base score is 7.4 (High) with a network vector, low attack complexity, and no user interaction, but critically PR:L - meaning valid low-privilege authentication to the device is required, which materially reduces the unauthenticated-worm risk. Exploit maturity is E:P (Proof-of-Concept), and a public POC is confirmed via a GitHub issue reference, so the barrier to weaponization is low. There is no KEV listing and no EPSS probability supplied, so there is no evidence of active, widespread exploitation at this time - this reads as a real but not emergency issue, prioritized by exposure of the management interface. Note a common uncertainty with router web-endpoint bugs: although the vector states PR:L, many Tenda goform handlers are reachable pre-authentication in practice, so the true privilege requirement should be verified against the firmware - if it is actually unauthenticated, real-world risk rises sharply. Data is single-sourced (VulDB), which lowers confidence relative to a vendor-confirmed advisory. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the router's web interface - or, if the endpoint is exposed to the WAN or an adjacent network, a remote attacker who reaches it - sends a crafted HTTP request to /goform/DhcpListClient with an oversized 'page' argument. This overflows a stack buffer in fromDhcpListClient, crashing the router (DoS) or, given published POC code and typical SOHO mitigation gaps, potentially executing attacker-supplied code to take control of the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) lets an attacker corrupt the stack by supplying an oversized 'page' argument to the /goform/DhcpListClient web endpoint handled by the fromDhcpListClient function. The flaw is reachable over the network and publicly available exploit code exists (disclosed via VulDB), though it is not listed in CISA KEV and no EPSS score was provided. Per the supplied CVSS 4.0 vector (PR:L) the attack requires low-level authentication to the device, and successful exploitation can crash the router or potentially achieve arbitrary code execution.
RemediationAI
No vendor-released patch identified at time of analysis; no fixed firmware version is cited in the available data, so monitor https://www.tenda.com.cn/ for a firmware update for the BE12 Pro superseding 16.03.66.23 and apply it once published. As compensating controls, disable remote/WAN-side access to the web management interface so /goform endpoints are not reachable from the internet (trade-off: administration must be done from the LAN); restrict LAN access to the management UI to a trusted management VLAN or specific admin hosts via firewall/ACL rules (trade-off: added network configuration); change default administrator credentials and enforce strong authentication since exploitation per the CVSS vector requires low-privilege access (trade-off: none significant); and if feasible place the device behind a network firewall/IPS that can filter anomalous requests to /goform/DhcpListClient (trade-off: SOHO environments may lack such controls). Track the VulDB entry (https://vuldb.com/vuln/378242) for fix updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded HTTP/goform web management interface of a consumer Tenda BE12 Pro Wi-Fi 7 router. The fromDhcpListClient routine that serves the /goform/DhcpListClient page (which renders the DHCP client list) copies the attacker-controlled 'page' parameter into a fixed-size stack buffer without adequate bounds checking. This maps to CWE-121 (Stack-based Buffer Overflow): writing past the end of a stack allocation overwrites adjacent stack data such as saved registers and the return address. Because these SOHO routers typically run on MIPS/ARM Linux with weak or absent exploit mitigations (limited ASLR, non-existent stack canaries in vendor binaries), such overflows are frequently convertible from a denial-of-service into remote code execution. The single affected CPE is cpe:2.3:a:tenda:be12_pro:*:*:*:*:*:*:*:*.
Know when Be12 Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable goform endpoint with low complexity; PR:L reflects the authenticated access stated in the vector; a stack overflow plausibly yields full RCE, so C/I/A:H.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in Tenda BE12 Pro 16.03.66.23. The affected element is the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the argument page causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.
Executive ViewAI
Your organization may be operating Tenda BE12 Pro routers (firmware 16.03.66.23 and earlier) containing a stack overflow vulnerability for which publicly available exploit code exists. While exploitation requires authentication to the device, this poses meaningful insider risk; network administrators or compromised accounts could disable infrastructure or gain unauthorized device control.
No vendor-released patch identified at time of analysis. Implement network-layer controls: restrict administrative access via firewall rules limiting web interface connections to approved management subnets; disable remote management and HTTP/HTTPS administrative endpoints; monitor for suspicious administrative activity or malformed requests to router management endpoints; segment the network to prevent lateral movement if the device is compromised; maintain offline configuration backups for rapid recovery.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) allows remote attackers to corrupt memor
Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) lets attackers corrupt memory by manipul
Stack-based buffer overflow in the Tenda BE12 Pro router firmware 16.03.66.23 lets an authenticated remote attacker corr
Stack-based buffer overflow in the Tenda BE12 Pro (firmware 16.03.66.23) web management interface lets an attacker corru
Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) lets remote attackers corrupt memo
Exploit-DB