Tenda BE12 Pro CVE-2026-15696

Exploitation targets the specific /goform/VirtualSer endpoint and its fromVirtualSer handler on Tenda BE12 Pro firmware 16.03.66.23, triggered by an overly long 'page' parameter. Per the CVSS vector, the attack requires low privileges (PR:L) and no user interaction (UI:N) - meaning the attacker needs a valid/administrative web session or working credentials (often the device's default admin password) and network reachability to the management interface. Limiting factors: the vulnerable Virtual Server configuration page must be reachable, which by default is LAN-side only unless remote management is enabled, and it is confined to this one router model and firmware build. Note the description states the attack 'can be launched remotely' while the vector specifies PR:L; the authentication requirement should be confirmed with the vendor as the two signals are not fully aligned.

Signals are mixed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates network-reachable, low-complexity exploitation with high impact to confidentiality, integrity, and availability, but crucially requires some level of privilege (PR:L) - consistent with needing a valid session or the device's (often default/weak) admin credentials to reach the configuration endpoint. Exploit maturity is E:P (Proof-of-Concept), matching the 'publicly available exploit' signal. There is no EPSS score provided and no CISA KEV listing, so there is no evidence of active mass exploitation - the realistic threat is opportunistic attacks against internet-exposed or LAN-adjacent panels, especially where default credentials are unchanged. This is a genuine but not top-tier priority: real because a working PoC exists and impact is high, but bounded because it is a single niche consumer router model, exploitation needs privileges, and management interfaces are typically LAN-facing rather than WAN-facing by default. Note: PR:L conflicts with the 'attack can be launched remotely' phrasing in the description - verify whether authentication is truly required or whether the endpoint is reachable pre-auth on some configurations.

An attacker who can reach the router's web management interface (e.g., an authenticated LAN user, a device with obtained/default admin credentials, or via an exposed panel) sends a crafted POST to /goform/VirtualSer with an oversized 'page' argument. The oversized value overflows a fixed-size stack buffer in fromVirtualSer, overwriting the return address to crash the httpd service (denial of service) or, with a tailored payload, execute attacker-controlled code as root. A public proof-of-concept for this exact endpoint is already available, lowering the effort to reproduce.