Technical impact
The vulnerability is a stack‑based buffer overflow (CWE‑119 and CWE‑120) in the formWifiBasicSet function of the Tenda BE3L Pro router firmware 16.03.60.62. By supplying a crafted security_5g argument to the /goform/WifiBasicSet endpoint, an attacker can overwrite memory, corrupt the stack, and execute arbitrary code with the privileges of the router’s firmware process. The description notes that the exploit is already published and can be initiated remotely, meaning an outsider can trigger it without prior access to the local network.
Affected Systems
The only documented affected product is the Tenda BE3L Pro wireless router running firmware version 16.03.60.62. No other revisions are listed as vulnerable in the CNA data, although the risk may extend to earlier or later builds not yet analyzed.
Risk and Exploitability
The CVSS score of 9.4 indicates a critical severity, and because the exploit code is publicly available the likelihood of successful exploitation is high. EPSS information is absent, but the remote attack vector and published exploit raise the overall risk. The vulnerability is not yet listed in the CISA Known‑Exploited Vulnerabilities catalog, yet the lack of available mitigations in many deployments keeps the threat level elevated for externally exposed devices.
