Stack-Based Buffer Overflow in Tenda BE12 Pro

Executive Summary

CVE-2026-15695 is a stack-based buffer overflow vulnerability in the Tenda BE12 Pro router, specifically in firmware version 16.03.66.23. The issue occurs in the `fromDhcpListClient` function within the `/goform/DhcpListClient` endpoint.

The vulnerability arises because the function uses the unsafe `sprintf` function to write user-controlled input from the `page` parameter into a fixed-size 256-byte buffer without proper length validation. If the input exceeds 256 bytes, it can overwrite adjacent memory, leading to memory corruption.

• This can result in application crashes, arbitrary code execution, or unauthorized access to the device.
• The attack can be initiated remotely without authentication by sending a POST request with an oversized `page` parameter.

The vendor, Shenzhen Jixiang Tengda Technology Co., Ltd., has not yet released a patch for this vulnerability.

Useful 0 Not Useful 0

Detection Guidance

To detect the CVE-2026-15695 vulnerability on your network or system, you can check if the Tenda BE12 Pro router is running the affected firmware version (V16.03.66.23).

• Inspect the router's firmware version by accessing its web interface or administrative console. Look for the firmware version in the system information or status page.
• Use network scanning tools to identify Tenda BE12 Pro devices on your network. Tools like Nmap can help detect devices and their firmware versions if supported.

To test for the vulnerability, you can attempt to send a crafted POST request to the `/goform/DhcpListClient` endpoint with an oversized `page` parameter. However, this should be done in a controlled environment as it may crash the device or cause unintended behavior.

• Example command to test for the vulnerability (use with caution):
• curl -X POST http://<router_ip>/goform/DhcpListClient -d "page=<oversized_input>"

If the router crashes or behaves abnormally, it may indicate the presence of the vulnerability. Ensure you have permission to test the device and are aware of the risks involved.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts if exploited, including:

• Device crashes or instability: An attacker could crash the router, disrupting network connectivity.
• Arbitrary code execution: An attacker could execute malicious code on the router, gaining control over it.
• Data confidentiality risks: Sensitive information stored on or passing through the router could be leaked or intercepted.
• Network compromise: The router could be used as a launchpad for further attacks, such as monitoring network traffic, redirecting users to malicious sites, or spreading malware to other devices on the network.
• Loss of control: An attacker could take full control of the router, altering settings, blocking access, or using it for malicious activities like botnets.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can impact compliance with several standards and regulations, depending on the context in which the affected router is used:

• GDPR (General Data Protection Regulation): If the router is used in an environment handling personal data of EU citizens, exploitation of this vulnerability could lead to unauthorized access or leakage of personal data. This would violate GDPR requirements for data protection and could result in significant fines or legal consequences.
• HIPAA (Health Insurance Portability and Accountability Act): In healthcare settings, if the router processes or transmits protected health information (PHI), this vulnerability could expose PHI to unauthorized access. This would violate HIPAA's security and privacy rules, leading to penalties and reputational damage.
• PCI DSS (Payment Card Industry Data Security Standard): If the router is part of a network processing payment card data, exploitation could lead to unauthorized access to cardholder data. This would violate PCI DSS requirements for securing cardholder data environments.
• Other standards: The vulnerability could also affect compliance with frameworks like ISO 27001, NIST, or sector-specific regulations that mandate secure handling of sensitive data and protection against unauthorized access.

Organizations using the affected router should assess their exposure and take mitigating actions to avoid compliance violations and potential legal or financial repercussions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate steps to mitigate CVE-2026-15695 include the following actions:

• Restrict access to the router's administrative interface from untrusted networks. Ensure the router is not exposed to the internet and is only accessible from a trusted local network.
• Disable remote management features if they are not required. This reduces the attack surface by preventing external access to the router's web interface.
• Apply network-level protections such as firewalls or intrusion prevention systems (IPS) to block malicious requests targeting the `/goform/DhcpListClient` endpoint.
• Monitor network traffic for unusual activity, such as repeated POST requests to the vulnerable endpoint, which may indicate exploitation attempts.
• If possible, replace the router with a model that is not affected by this vulnerability or wait for an official patch from the vendor (Shenzhen Jixiang Tengda Technology Co., Ltd.).

Long-term mitigations suggested by the resource include:

• Replacing unsafe functions like `sprintf` with safer alternatives such as `snprintf` to prevent buffer overflows.
• Implementing strict input length checks and validating the `page` parameter to ensure it does not exceed the buffer size.
• Applying least privilege principles to the service to limit the impact of potential exploitation.
• Adopting secure coding practices to prevent similar vulnerabilities in the future.

Useful 0 Not Useful 0