Description
A vulnerability has been found in Tenda BE12 Pro 16.03.66.23. The impacted element is the function fromVirtualSer of the file /goform/VirtualSer. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-07-14
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack‑based buffer overflow has been identified in the fromVirtualSer function within the /goform/VirtualSer endpoint of Tenda BE12 Pro routers. Manipulating the arguments supplied to this function can corrupt the call stack, potentially allowing an attacker to execute arbitrary code on the device. The vulnerability is classified under CWE‑119 and CWE‑121, indicating a classic memory corruption error that compromises the confidentiality, integrity, and availability of the affected device.

Affected Systems

The vulnerability affects Tenda BE12 Pro routers running firmware version 16.03.66.23.

Risk and Exploitability

The flaw carries a CVSS score of 8.7, indicating high severity, while its EPSS score of less than 1 % suggests a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but an exploit has been publicly disclosed and can be triggered remotely through standard HTTP requests to the management interface, enabling attackers to gain control of the device.

Generated by OpenCVE AI on July 31, 2026 at 10:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check for and apply any available Tenda firmware update that includes a fix for the stack overflow issue.
  • Disable remote management on the router or restrict access to the management interface to prevent external exploitation.
  • Restrict network access to the /goform/VirtualSer endpoint via firewall rules or network segmentation to limit attack surface.
  • Monitor network traffic for anomalous activity targeting the /goform/VirtualSer endpoint to detect potential exploitation attempts.

Generated by OpenCVE AI on July 31, 2026 at 10:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Tenda BE12 Pro 16.03.66.23. The impacted element is the function fromVirtualSer of the file /goform/VirtualSer. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Title Tenda BE12 Pro VirtualSer fromVirtualSer stack-based overflow
First Time appeared Tenda
Tenda be12 Pro
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:h:tenda:be12_pro:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda be12 Pro
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Be12 Pro
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-14T15:15:11.959Z

Reserved: 2026-07-14T04:58:22.099Z

Link: CVE-2026-15696

cve-icon Vulnrichment

Updated: 2026-07-14T15:14:04.104Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T10:30:17Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow