EUVD-2026-43677
GHSA-5w66-g5mr-5v9h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web UI with low-priv session
-
DeliverySend crafted request to /goform/SafeMacFilter
-
ExploitOverflow stack buffer via oversized 'page'
-
ExecutionOverwrite saved return address
-
ImpactCrash device or execute code on embedded OS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the router's HTTP management interface and invoking the fromSafeMacFilter handler at /goform/SafeMacFilter with a manipulated 'page' argument; the CVSS vector's PR:L means a low-privilege authenticated session on the management UI is required, and UI:N means no victim interaction is needed. The concrete limiting factors are: authentication/session on the web admin panel (PR:L, not unauthenticated), the specific target being Tenda BE12 Pro firmware 16.03.66.23, and network reachability of the admin interface - which for a SOHO router is typically LAN-side by default and only internet-exposed if remote WAN management has been explicitly enabled. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, base 7.4, E:P) indicates a network-reachable, low-complexity attack requiring some level of authentication (PR:L) and no user interaction, with high impact to confidentiality, integrity, and availability of the vulnerable system but no scope change. The E:P (Proof-of-Concept) exploit-maturity flag is consistent with the reported public POC. No EPSS score and no KEV listing were provided, so there is no evidence of at-scale or active exploitation - this is publicly available exploit code, not confirmed in-the-wild abuse. Practical risk is bounded by the fact that these router management interfaces are typically LAN-facing by default, meaning the 'network' vector is realistically an on-LAN or already-authenticated attacker unless remote WAN management is enabled. The most likely real-world outcome is denial of service (device crash/reboot); full remote code execution is plausible for these Tenda handlers but is not independently confirmed here. Overall this is a moderate-priority issue: credible and easy to trigger, but gated by PR:L and typical LAN exposure rather than an unauthenticated internet-wide threat. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the router's web interface (for example an authenticated user on the LAN, or via an internet-exposed management port if WAN management is enabled) sends a crafted HTTP request to /goform/SafeMacFilter with an oversized 'page' parameter. The overlong value overflows a fixed stack buffer in fromSafeMacFilter, overwriting the return address; given low attack complexity and a publicly available POC, this reliably crashes the device and may be developed into remote code execution on the embedded OS. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 14, 2026
Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) lets remote attackers corrupt memory by manipulating the 'page' argument of the fromSafeMacFilter handler at /goform/SafeMacFilter. Publicly available exploit code exists, though there is no public exploit identified as being used in active campaigns and it is not listed in CISA KEV. Successful exploitation can crash the device or potentially achieve code execution on the router's embedded OS. EPSS data was not provided.
Earlier versions of this analysis (1)
Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) lets an authenticated network attacker corrupt the stack of the fromSafeMacFilter handler by supplying an oversized 'page' argument to the /goform/SafeMacFilter endpoint. Publicly available exploit code exists (disclosed via VulDB), and successful exploitation can crash the device or achieve arbitrary code execution on the router. This is a CWE-121 flaw carrying a CVSS 4.0 base score of 8.7 (High), with a proof-of-concept exploitation maturity but no confirmation of active in-the-wild exploitation.
RemediationAI
No vendor-released patch identified at time of analysis - no fixed firmware version is cited in the source data, so monitor Tenda (https://www.tenda.com.cn/) and the VulDB entry (https://vuldb.com/vuln/378240) for an updated build and apply it once released. As compensating controls: disable remote/WAN web management so the /goform/SafeMacFilter endpoint is not reachable from the internet (trade-off: loss of remote administration convenience); restrict access to the router's HTTP management interface to a trusted management VLAN or specific admin hosts via ACL (trade-off: administrative overhead); change default administrator credentials and avoid sharing the low-privilege account exploitation depends on, since the CVSS vector requires PR:L (trade-off: none significant); and if the SafeMacFilter/MAC-filter feature is unused, avoid exposing that configuration page and consider network segmentation to limit which clients can reach the admin UI. Reboot/monitoring procedures should be in place because a failed exploit attempt will likely crash the device.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the web-management HTTP interface of a consumer/SOHO Tenda BE12 Pro router. The vulnerable code path is the fromSafeMacFilter function serving the /goform/SafeMacFilter endpoint, which implements the MAC-address safe/allow-list filter feature. The 'page' request parameter is copied into a fixed-size stack buffer without adequate bounds checking, matching CWE-121 (Stack-based Buffer Overflow). Tenda's SOHO firmware is built on embedded Linux with lightweight goform CGI-style handlers written in C, where unchecked strcpy/sprintf-style operations into local stack arrays are a recurring pattern; overflowing the buffer overwrites the saved return address and adjacent stack data, giving an attacker control over execution flow on a MIPS/ARM embedded target. The single affected product per the CPE is cpe:2.3:a:tenda:be12_pro:*:*:*:*:*:*:*:* (firmware 16.03.66.23 named in the description).
Know when Be12 Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable low-complexity overflow needing a low-privilege web-admin session (PR:L); memory-corruption on the device gives high C/I/A with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23. This issue affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
Tenda BE12 Pro routers running firmware version 16.03.66.23 contain a remotely exploitable buffer overflow (CVE-2026-15693) with publicly available exploit code that can crash the device or enable unauthorized code execution. No patch is currently available from the vendor, leaving affected organizations without a standard remediation path. Networks deploying this hardware face risk of availability loss, route hijacking, and potential compromise of internal systems through a compromised network access point.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict management interface access to administrative networks via firewall rules; implement network segmentation to isolate vulnerable routers from business-critical systems; monitor for IDS/IPS signatures for exploitation attempts; establish daily monitoring of Tenda advisories for patch announcements; consider temporary network topology changes to route traffic through alternative gateways if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) allows remote attackers to corrupt memor
Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) lets an attacker corrupt the stack
Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) lets attackers corrupt memory by manipul
Stack-based buffer overflow in the Tenda BE12 Pro router firmware 16.03.66.23 lets an authenticated remote attacker corr
Stack-based buffer overflow in the Tenda BE12 Pro (firmware 16.03.66.23) web management interface lets an attacker corru
Exploit-DB