Which versions of Tenda BE12 Pro are affected by CVE-2026-15696?

Tenda BE12 Pro routers (firmware 16.03.66.23) contain a buffer overflow vulnerability (CVE-2026-15696) that enables network attackers to crash devices or potentially gain administrative control,…

Is there a public PoC exploit available for CVE-2026-15696?

Yes, a public proof-of-concept exploit is available for CVE-2026-15696. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2026-15696?

Within 24 hours: audit the network to identify all Tenda BE12 Pro routers with firmware 16.03.66.23 and implement firewall rules to block external access to the /goform/VirtualSer endpoint. Within 7 days: apply network segmentation to isolate affected devices from untrusted network segments and restrict administrative access to authorized personnel and systems. Within 30 days: contact Tenda for patches or replacement timelines for affected firmware version 16.03.66.23, evaluate upgrading to alternative router models if timely patching is unavailable, and review network access logs for exploitation attempts during the vulnerability window.

Tenda BE12 Pro CVE-2026-15696

Q: What is the CVSS score of CVE-2026-15696?

CVE-2026-15696 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-43691 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-14 VulDB

GHSA-h9wr-9gfr-4wqp

Tenda Buffer Overflow Stack Overflow Be12 Pro

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web endpoint (AV:N, AC:L) requiring a valid low-privilege management session (PR:L, UI:N); stack overflow in root-run httpd yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 15:33 vuln.today

CVSS changed

Jul 14, 2026 - 15:22 NVD

8.7 (HIGH) 7.4 (HIGH)

CVE Published

Jul 14, 2026 - 14:45 cve.org

HIGH 7.4

DescriptionCVE.org

A vulnerability has been found in Tenda BE12 Pro 16.03.66.23. The impacted element is the function fromVirtualSer of the file /goform/VirtualSer. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) allows remote attackers to corrupt memory via the fromVirtualSer handler for the /goform/VirtualSer endpoint by supplying an oversized 'page' argument. The flaw carries CVSS 4.0 7.4 and, per its vector, requires low-level privileges (PR:L); publicly available exploit code exists, though there is no public exploit identified as actively used in the wild (not in CISA KEV). Successful exploitation can crash the device or potentially lead to arbitrary code execution on the embedded MIPS/ARM firmware.

Technical ContextAI

The affected component is the web-management CGI-style handler fromVirtualSer, invoked through the /goform/VirtualSer route used to configure the router's Virtual Server (port-forwarding) feature. This is a classic CWE-121 stack-based buffer overflow: attacker-controlled input from the 'page' request parameter is copied into a fixed-size stack buffer (typically via unbounded strcpy/sprintf calls common in Tenda's httpd binary) without length validation, overwriting the saved return address and adjacent stack data. The CPE cpe:2.3:a:tenda:be12_pro identifies the Tenda BE12 Pro Wi-Fi 7 consumer/SMB router firmware as the affected product. On these embedded devices the web server usually runs as root, so memory corruption in the request parser can escalate directly to full device compromise.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda had not published a fixed firmware version in the provided data, so monitor https://www.tenda.com.cn/ for a firmware update for the BE12 Pro superseding 16.03.66.23 and apply it once released. As compensating controls, disable remote/WAN-side web management so the /goform/VirtualSer endpoint is unreachable from the internet (side effect: loses remote admin convenience); restrict access to the management interface to a trusted management VLAN or specific admin IPs via ACL (side effect: requires network segmentation setup); change default administrator credentials and enforce a strong password to raise the bar for the PR:L precondition; and avoid using or exposing the Virtual Server / port-forwarding configuration page where possible. If feasible, place the router behind an upstream firewall that blocks unsolicited access to its HTTP management port. Reference the disclosure at https://vuldb.com/vuln/378243 and the PoC issue at https://github.com/cve-a/dexingzhiqing/issues/6 to validate detection and confirm patched status.