CVE-2026-15691 Overview
CVE-2026-15691 is a stack-based buffer overflow vulnerability in the Tenda BE12 Pro router running firmware version 16.03.66.23. The flaw resides in the fromSafeClientFilter function processing requests to /goform/SafeClientFilter. An attacker can manipulate the page argument to overflow a fixed-size stack buffer. The vulnerability is exploitable remotely over the network and requires low-level privileges. Public exploit code has been released, increasing the likelihood of opportunistic attacks against exposed devices. The weakness is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).
Critical Impact
Remote attackers with low-level authentication can trigger a stack-based buffer overflow that may lead to arbitrary code execution or denial of service on affected Tenda BE12 Pro devices.
Affected Products
- Tenda BE12 Pro firmware version 16.03.66.23
- /goform/SafeClientFilter HTTP endpoint
- fromSafeClientFilter function within the router web management interface
Discovery Timeline
- 2026-07-14 - CVE-2026-15691 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-15691
Vulnerability Analysis
The vulnerability exists in the fromSafeClientFilter handler exposed through the router's web management interface at /goform/SafeClientFilter. This handler processes the page HTTP parameter without proper bounds validation before copying it into a fixed-size stack buffer. The condition maps to [CWE-119], which covers improper restriction of operations within memory buffer bounds. Successful exploitation can corrupt adjacent stack memory, including saved return addresses and frame pointers used by the router's HTTP daemon. An attacker who overwrites the return address can redirect execution flow to attacker-controlled data, enabling arbitrary code execution on the embedded Linux system. At minimum, a malformed request can crash the web management service and disrupt network connectivity for downstream clients.
Root Cause
The root cause is missing length validation on the page parameter before it is copied into a stack-allocated buffer inside fromSafeClientFilter. Tenda's SOHO router firmware historically uses unsafe string copy routines such as strcpy and sprintf in goform handlers, allowing user-controlled HTTP parameters to exceed destination buffer sizes.
Attack Vector
Exploitation requires network reachability to the router's HTTP management interface and low-privilege authenticated access. An attacker submits a crafted HTTP request to /goform/SafeClientFilter with an oversized page value. The overflow overwrites stack metadata, potentially achieving remote code execution as the web service process. Refer to the VulDB Vulnerability Report and the GitHub Issue Report for technical details on the parameter handling flaw.
Detection Methods for CVE-2026-15691
Indicators of Compromise
- HTTP POST or GET requests to /goform/SafeClientFilter containing an abnormally long page parameter value.
- Unexpected restarts or crashes of the Tenda web management daemon (httpd) logged in router event history.
- Outbound connections from the router to unfamiliar hosts following management interface activity.
Detection Strategies
- Inspect HTTP request logs at network perimeter proxies for oversized parameter values targeting /goform/ endpoints on Tenda devices.
- Deploy IDS/IPS signatures that flag requests to SafeClientFilter where the page argument exceeds expected length thresholds.
- Correlate router management interface access with source IPs outside the administrative subnet.
Monitoring Recommendations
- Restrict and monitor administrative access to router management interfaces from untrusted networks.
- Alert on repeated authentication attempts followed by requests to goform endpoints, which may indicate exploit staging.
- Track firmware version inventory across Tenda BE12 Pro devices to identify unpatched units.
How to Mitigate CVE-2026-15691
Immediate Actions Required
- Disable remote WAN-side administration on all Tenda BE12 Pro devices to reduce internet-facing exposure.
- Restrict LAN-side management access to a dedicated administrative VLAN or trusted management workstations.
- Rotate router administrator credentials to reduce the risk of low-privilege account compromise leading to exploitation.
Patch Information
At the time of publication, no vendor-issued firmware patch for CVE-2026-15691 has been referenced in the NVD entry. Monitor the Tenda Website Security Info portal and the VulDB CVE-2026-15691 advisory for firmware updates addressing the fromSafeClientFilter handler.
Workarounds
- Block external access to TCP ports used by the router's HTTP management interface at the upstream firewall.
- Place the router behind a segmentation boundary that restricts management plane traffic to authenticated administrative sources.
- Consider replacing end-of-support SOHO hardware if no vendor patch becomes available within an acceptable window.
# Example: block WAN access to router HTTP management on an upstream firewall
iptables -I FORWARD -p tcp -d <router_wan_ip> --dport 80 -j DROP
iptables -I FORWARD -p tcp -d <router_wan_ip> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
