Stack-Based Buffer Overflow in Tenda BE12 Pro

Executive Summary

CVE-2026-15691 is a stack-based buffer overflow vulnerability in the Tenda BE12 Pro router, specifically in firmware version 16.03.66.23. The flaw exists in the fromSafeClientFilter function of the /goform/SafeClientFilter endpoint.

The vulnerability occurs when the page argument is manipulated. The function uses the unsafe sprintf function to process this input without proper length validation. Since the buffer has a fixed size of 256 bytes, input exceeding this limit can overwrite adjacent memory, leading to memory corruption.

This can result in application crashes, arbitrary code execution, or sensitive information leakage. The attack can be carried out remotely, and no authentication is required. A proof-of-concept exploit demonstrates the vulnerability by sending a POST request with an oversized page parameter.

Useful 0 Not Useful 0

Detection Guidance

To detect the vulnerability in Tenda BE12 Pro 16.03.66.23, you can check for the presence of the affected firmware version and test for the vulnerable endpoint.

• Verify the firmware version: Access the Tenda router admin panel and check if the firmware version is 16.03.66.23. This can typically be found in the system settings or status page.
• Test the vulnerable endpoint: Use a tool like curl to send a crafted POST request to the /goform/SafeClientFilter endpoint with an oversized 'page' parameter. For example:
• curl -X POST http://<router-ip>/goform/SafeClientFilter -d "page=<long_string_of_256+_characters>"
• Monitor the router's response. If the router crashes, becomes unresponsive, or behaves abnormally, it may indicate the presence of the vulnerability.
• Use network scanning tools like Nmap to identify Tenda BE12 Pro devices on your network. For example:
• nmap -p 80,443 --script http-title <network-range> | grep "Tenda"

If the vulnerability is confirmed, immediate mitigation steps should be taken to prevent exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several severe impacts if exploited:

• Denial of Service (DoS): An attacker can crash the router, disrupting network connectivity for all connected devices.
• Arbitrary Code Execution: An attacker may execute malicious code on the router, gaining full control over it.
• Sensitive Information Leakage: The attacker could access or exfiltrate sensitive data transmitted through the router, such as login credentials or personal information.
• Network Compromise: The router could be used as a pivot to launch further attacks on other devices within the network.
• Traffic Monitoring: An attacker could monitor or intercept network traffic, potentially capturing unencrypted communications.

Since the exploit is public and can be executed remotely, the risk of exploitation is significant if the router remains unpatched.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can impact compliance with several common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If the router is used in an environment handling personal data of EU citizens, exploitation of this vulnerability could lead to unauthorized access or leakage of personal data. This may result in violations of GDPR's data protection and breach notification requirements, potentially leading to fines or legal action.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), this vulnerability could expose sensitive patient data. Unauthorized access to PHI due to this flaw may constitute a HIPAA violation, resulting in penalties and mandatory corrective actions.
• PCI DSS (Payment Card Industry Data Security Standard): If the router is part of a network processing payment card data, exploitation could lead to unauthorized access to cardholder data. This would violate PCI DSS requirements for securing cardholder data, potentially leading to fines or loss of payment processing capabilities.
• ISO 27001: This standard requires organizations to implement controls to manage information security risks. Failure to patch or mitigate this vulnerability could be seen as a failure to maintain adequate security controls, potentially leading to non-compliance during audits.

Organizations must address this vulnerability promptly to avoid compliance violations, reputational damage, and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability in Tenda BE12 Pro 16.03.66.23, follow these immediate steps:

• Apply the latest firmware update: Check Tenda's official website for a patched firmware version and update the router immediately. Firmware updates often include security fixes for known vulnerabilities.
• Restrict access to the router's admin panel: Disable remote administration and ensure the admin interface is only accessible from trusted internal networks. Use strong, unique passwords for the admin account.
• Isolate the router from critical networks: If possible, segment the router from other critical devices to limit the potential impact of an exploit.
• Monitor network traffic: Use network monitoring tools to detect unusual activity, such as repeated requests to the /goform/SafeClientFilter endpoint or unexpected crashes.
• Replace unsafe functions: If you have access to the router's source code or can influence the vendor, replace the unsafe sprintf function with safer alternatives like snprintf and implement strict input validation.
• Implement network-level protections: Use firewalls or intrusion detection/prevention systems (IDS/IPS) to block or alert on suspicious requests targeting the vulnerable endpoint.
• Consider replacing the device: If no firmware update is available or the device is no longer supported, consider replacing it with a more secure alternative.

Useful 0 Not Useful 0