Which versions of Tenda BE12 Pro are affected by CVE-2026-15695?

Your organization may be operating Tenda BE12 Pro routers (firmware 16.03.66.23 and earlier) containing a stack overflow vulnerability for which publicly available exploit code exists.

Is there a public PoC exploit available for CVE-2026-15695?

Yes, a public proof-of-concept exploit is available for CVE-2026-15695. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2026-15695?

Within 24 hours: audit your network inventory to identify all Tenda BE12 Pro routers and verify their firmware versions. Within 7 days: implement network access controls blocking unauthorized administrative access to the device's web interface and disable remote management features; restrict router administrator accounts to essential personnel only and enforce strong authentication. Within 30 days: contact Tenda to confirm patch availability and timeline; if no patch is forthcoming, prioritize replacement with routers from vendors with established security practices, or implement network segmentation to contain potential compromise.

Tenda BE12 Pro CVE-2026-15695

Q: What is the CVSS score of CVE-2026-15695?

CVE-2026-15695 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-43686 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-14 VulDB

GHSA-g3hf-vcqh-qj2p

Buffer Overflow Stack Overflow Tenda Be12 Pro

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable goform endpoint with low complexity; PR:L reflects the authenticated access stated in the vector; a stack overflow plausibly yields full RCE, so C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 15:32 vuln.today

CVSS changed

Jul 14, 2026 - 15:22 NVD

8.7 (HIGH) 7.4 (HIGH)

CVE Published

Jul 14, 2026 - 14:30 cve.org

HIGH 7.4

DescriptionCVE.org

A flaw has been found in Tenda BE12 Pro 16.03.66.23. The affected element is the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the argument page causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.

AnalysisAI

Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) lets an attacker corrupt the stack by supplying an oversized 'page' argument to the /goform/DhcpListClient web endpoint handled by the fromDhcpListClient function. The flaw is reachable over the network and publicly available exploit code exists (disclosed via VulDB), though it is not listed in CISA KEV and no EPSS score was provided. Per the supplied CVSS 4.0 vector (PR:L) the attack requires low-level authentication to the device, and successful exploitation can crash the router or potentially achieve arbitrary code execution.

Technical ContextAI

The affected component is the embedded HTTP/goform web management interface of a consumer Tenda BE12 Pro Wi-Fi 7 router. The fromDhcpListClient routine that serves the /goform/DhcpListClient page (which renders the DHCP client list) copies the attacker-controlled 'page' parameter into a fixed-size stack buffer without adequate bounds checking. This maps to CWE-121 (Stack-based Buffer Overflow): writing past the end of a stack allocation overwrites adjacent stack data such as saved registers and the return address. Because these SOHO routers typically run on MIPS/ARM Linux with weak or absent exploit mitigations (limited ASLR, non-existent stack canaries in vendor binaries), such overflows are frequently convertible from a denial-of-service into remote code execution. The single affected CPE is cpe:2.3:a:tenda:be12_pro:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch identified at time of analysis; no fixed firmware version is cited in the available data, so monitor https://www.tenda.com.cn/ for a firmware update for the BE12 Pro superseding 16.03.66.23 and apply it once published. As compensating controls, disable remote/WAN-side access to the web management interface so /goform endpoints are not reachable from the internet (trade-off: administration must be done from the LAN); restrict LAN access to the management UI to a trusted management VLAN or specific admin hosts via firewall/ACL rules (trade-off: added network configuration); change default administrator credentials and enforce strong authentication since exploitation per the CVSS vector requires low-privilege access (trade-off: none significant); and if feasible place the device behind a network firewall/IPS that can filter anomalous requests to /goform/DhcpListClient (trade-off: SOHO environments may lack such controls). Track the VulDB entry (https://vuldb.com/vuln/378242) for fix updates.