Tenda BE12 Pro EUVD-2026-43680

Exploitation requires reaching the /goform/SetIpBind endpoint on a Tenda BE12 Pro (firmware 16.03.66.23) and supplying an oversized value in the 'page' argument to trigger the fromSetIpBind stack overflow. The CVSS vector's PR:L indicates low-privilege access is required - in practice an authenticated management session or access to the router's HTTP admin interface - which limits fully unauthenticated internet-wide exploitation; by default this interface is typically LAN-facing, so remote attack usually presumes an exposed or remotely-enabled management port or an attacker already on the local network. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factors are the low-privilege/authentication requirement and network reachability of the management interface.

Signals are mixed. The CVSS 4.0 base score of 7.4 (High) reflects network vector, low complexity, no user interaction, and full CIA impact, but PR:L indicates authentication/low privileges are required, which meaningfully limits mass exploitation - an attacker generally needs an authenticated session or access to the router's management interface (often LAN-side by default). Exploit maturity is Proof-of-Concept (E:P) and public exploit code is confirmed, raising practical risk for exposed or credential-weak devices. No EPSS score and no KEV listing were provided, and there is no evidence of active exploitation, so this appears to be a publicly-disclosed-with-POC issue rather than a confirmed in-the-wild campaign. The reporting source is VulDB (a vulnerability database/crowd-sourced submission), not the vendor, so affected-version scope beyond the single tested firmware is not independently confirmed. Net: a genuine High-priority patch item for anyone running this exact router, but the PR:L requirement and lack of KEV/EPSS temper the likelihood of untargeted internet-wide exploitation.

An attacker with access to the router's web interface (e.g., via the LAN, a weak/default admin credential, or an exposed management port) sends a crafted request to /goform/SetIpBind with an oversized 'page' parameter, overflowing the stack buffer in fromSetIpBind. This crashes the management daemon (denial of service) or, given the typically weak mitigations on embedded firmware, is leveraged to execute attacker-controlled code on the device. Public proof-of-concept exploit code for this flaw is already available.