Description
A vulnerability was detected in Tenda BE12 Pro 16.03.66.23. Impacted is the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
Published: 2026-07-14
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack‑based buffer overflow exists in the fromSetIpBind function of the /goform/SetIpBind endpoint on the Tenda BE12 Pro. The flaw is triggered by manipulating the page parameter, allowing a remote attacker to overflow a stack buffer and execute arbitrary code on the device. The vulnerability is a classic memory corruption weakness, classified as CWE‑119 and CWE‑121.

Affected Systems

The reported product is the Tenda BE12 Pro running firmware 16.03.66.23. No other Tenda models, firmware versions, or builds have been identified as affected.

Risk and Exploitability

The CVSS v3 score of 8.7 indicates high severity. The EPSS score of less than 1 % indicates a low but non‑zero likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. Exploitation can be achieved by sending a crafted HTTP request to the /goform/SetIpBind endpoint with an abnormal page value. If successful the attacker gains code execution privileges on the appliance.

Generated by OpenCVE AI on July 31, 2026 at 10:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the device firmware to the latest version released by Tenda that addresses the overflow flaw
  • Limit exposure by restricting the /goform/SetIpBind endpoint to trusted networks or block it using a firewall or ACL
  • If a firmware update is unavailable, temporarily disable the SetIpBind function by blocking its HTTP endpoint via the device’s configuration or an external network appliance

Generated by OpenCVE AI on July 31, 2026 at 10:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Tenda BE12 Pro 16.03.66.23. Impacted is the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
Title Tenda BE12 Pro SetIpBind fromSetIpBind stack-based overflow
First Time appeared Tenda
Tenda be12 Pro
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:h:tenda:be12_pro:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda be12 Pro
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Be12 Pro
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-14T14:35:17.481Z

Reserved: 2026-07-14T04:58:16.916Z

Link: CVE-2026-15694

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T10:30:17Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow