CVE-2026-15692: Tenda BE12 Pro Buffer Overflow Vulnerability

CVE-2026-15692 Overview

CVE-2026-15692 is a stack-based buffer overflow vulnerability in the Tenda BE12 Pro router running firmware version 16.03.66.23. The flaw resides in the fromSafeUrlFilter function within the /goform/SafeUrlFilter endpoint. Attackers can trigger the overflow by manipulating the page argument, corrupting the stack of the web management service. The vulnerability is exploitable remotely across the network and requires low privileges. Public exploit code has been disclosed, increasing the risk of opportunistic exploitation against exposed devices. This weakness is classified under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.

Critical Impact
Remote attackers with low-privileged access can corrupt the router's stack memory through the page parameter, potentially achieving arbitrary code execution or persistent denial of service on the affected Tenda BE12 Pro device.

Affected Products

Tenda BE12 Pro firmware version 16.03.66.23
/goform/SafeUrlFilter web management endpoint
fromSafeUrlFilter handler function within the router's HTTP daemon

Discovery Timeline

2026-07-14 - CVE-2026-15692 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15692

Vulnerability Analysis

The vulnerability exists in the fromSafeUrlFilter function that services requests to the /goform/SafeUrlFilter URI on the Tenda BE12 Pro web administration interface. The handler reads the page HTTP parameter and copies its contents into a fixed-size stack buffer without validating the input length. When an attacker submits an oversized page value, the copy operation writes past the buffer boundary and overwrites adjacent stack data, including the saved return address. Successful exploitation can redirect execution flow to attacker-controlled memory, enabling arbitrary code execution as the web server process. At minimum, the corruption crashes the HTTP daemon and disrupts router management.

Root Cause

The root cause is missing bounds checking on the page parameter before it is copied into a stack-allocated buffer inside fromSafeUrlFilter. This is a classic [CWE-119] memory boundary violation and reflects unsafe use of string copy primitives in the request-handling code path. Input validation is not applied consistently across /goform/ endpoints in the affected firmware.

Attack Vector

Exploitation is performed over the network by sending a crafted HTTP request to the router's web management interface targeting /goform/SafeUrlFilter. The attacker submits an oversized page parameter designed to overflow the destination buffer. Authenticated low-privilege access to the web interface is required. Devices exposing the management interface to untrusted networks, or reachable via cross-site request forgery from a management-network browser, face heightened risk. A public proof-of-concept has been referenced on GitHub and cataloged by VulDB.

// No verified exploit code is republished here.
// See the linked GitHub issue and VulDB entries for technical details
// on the crafted HTTP request targeting the `page` parameter of
// /goform/SafeUrlFilter on Tenda BE12 Pro 16.03.66.23.

Detection Methods for CVE-2026-15692

Indicators of Compromise

HTTP POST or GET requests to /goform/SafeUrlFilter containing abnormally long page parameter values, particularly exceeding a few hundred bytes.
Unexpected restarts, crash logs, or watchdog reboots of the router's httpd process shortly after web management traffic.
Outbound connections from the router to unknown hosts following administrative HTTP activity, indicating possible post-exploitation callback.

Detection Strategies

Deploy network intrusion detection signatures that flag requests to /goform/SafeUrlFilter with page parameter lengths above a safe threshold.
Correlate web management access logs with router uptime resets to identify overflow-induced crashes.
Inspect HTTP request bodies destined for Tenda management interfaces for repeating byte patterns or shellcode-like content in the page field.

Monitoring Recommendations

Enable and forward router syslog to a central collector, focusing on httpd crash and reboot messages.
Monitor administrative subnets for unauthorized HTTP sessions to router IPs on ports 80 and 443.
Track configuration changes and firmware version drift on Tenda devices via periodic authenticated audits.

How to Mitigate CVE-2026-15692

Immediate Actions Required

Restrict access to the Tenda BE12 Pro web management interface to trusted management VLANs and block it from the WAN.
Change default and low-strength administrator credentials to reduce the chance of an attacker satisfying the low-privilege prerequisite.
Monitor Tenda security advisories on the Tenda Official Website for a firmware update addressing fromSafeUrlFilter.
Isolate exposed devices behind a network firewall that enforces ACLs on HTTP management traffic.

Patch Information

At the time of publication, no vendor-supplied firmware patch for CVE-2026-15692 in Tenda BE12 Pro 16.03.66.23 has been referenced in NVD. Administrators should track updates from Tenda and apply firmware upgrades as soon as they are released. Refer to the VulDB entry for CVE-2026-15692 for ongoing status changes.

Workarounds

Disable remote management on the WAN interface and restrict LAN-side administration to specific management hosts.
Place the router behind an upstream firewall or reverse proxy that rate-limits and length-limits requests to /goform/ URIs.
Segment IoT and consumer-grade networking equipment away from sensitive production or user networks to contain post-exploitation impact.

bash

# Example upstream firewall rule to restrict router admin access
# Replace 192.0.2.10 with the trusted management host
# Replace 10.0.0.1 with the router's LAN IP
iptables -A FORWARD -s 192.0.2.10 -d 10.0.0.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 10.0.0.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 10.0.0.1 -p tcp --dport 443 -j DROP