CVE-2026-15691

Tenda BE12 Pro SafeClientFilter fromSafeClientFilter stack-based overflow

View on CVE.org
Published Jul 14, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

Analysis

AI-generated

Technical impact

A stack‑based buffer overflow exists in the fromSafeClientFilter function of the /goform/SafeClientFilter file on Tenda BE12 Pro devices. By manipulating the page argument remotely, an attacker can corrupt the stack and redirect execution flow, allowing the execution of arbitrary code or a denial‑of‑service condition. The flaw is classified as CWE‑119 and CWE‑121.

Affected Systems

The vulnerability affects the Tenda BE12 Pro router running firmware version 16.03.66.23. No additional vendors or product variants are listed in the supplied data.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, and the EPSS score of less than 1% implies a low current probability of widespread exploitation, yet the public release of exploit code raises concerns. The exploit is remote and does not require local victim interaction. The issue is not present in the CISA KEV catalog.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and flash the newest firmware release from the official Tenda support site that addresses the SafeClientFilter stack‑based overflow.
  • Reboot the router so that the updated firmware fully replaces the vulnerable code.
  • Limit management access to the device by configuring the firewall or router to block external traffic on ports used by the web interface, ensuring only trusted internal sources can reach the device until the vulnerability is confirmed fixed.

Generated by OpenCVE AI on July 31, 2026 at 10:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Title Tenda BE12 Pro SafeClientFilter fromSafeClientFilter stack-based overflow
First Time appeared Tenda
Tenda be12 Pro
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:h:tenda:be12_pro:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda be12 Pro
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 15, 2026, 2:44 PM
Reserved
Jul 14, 2026, 4:58 AM

View source JSON

Updated
Jul 15, 2026, 2:44 PM

JSON

Status
Deferred
Published
Jul 14, 2026, 1:18 PM
Modified
Oct 24, 2026, 9:10 PM

View source JSON

No data.

Updated
Sep 29, 2026, 7:30 AM

JSON