Description
A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-07-14
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack‑based buffer overflow exists in the fromSafeClientFilter function of the /goform/SafeClientFilter file on Tenda BE12 Pro devices. By manipulating the page argument remotely, an attacker can corrupt the stack and redirect execution flow, allowing the execution of arbitrary code or a denial‑of‑service condition. The flaw is classified as CWE‑119 and CWE‑121.

Affected Systems

The vulnerability affects the Tenda BE12 Pro router running firmware version 16.03.66.23. No additional vendors or product variants are listed in the supplied data.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, and the EPSS score of less than 1% implies a low current probability of widespread exploitation, yet the public release of exploit code raises concerns. The exploit is remote and does not require local victim interaction. The issue is not present in the CISA KEV catalog.

Generated by OpenCVE AI on July 31, 2026 at 10:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Download and flash the newest firmware release from the official Tenda support site that addresses the SafeClientFilter stack‑based overflow.
  • Reboot the router so that the updated firmware fully replaces the vulnerable code.
  • Limit management access to the device by configuring the firewall or router to block external traffic on ports used by the web interface, ensuring only trusted internal sources can reach the device until the vulnerability is confirmed fixed.

Generated by OpenCVE AI on July 31, 2026 at 10:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Title Tenda BE12 Pro SafeClientFilter fromSafeClientFilter stack-based overflow
First Time appeared Tenda
Tenda be12 Pro
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:h:tenda:be12_pro:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda be12 Pro
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Be12 Pro
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-15T14:44:12.835Z

Reserved: 2026-07-14T04:58:09.621Z

Link: CVE-2026-15691

cve-icon Vulnrichment

Updated: 2026-07-15T14:44:07.573Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T10:45:04Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow