CVE-2026-15693: Tenda BE12 Pro Buffer Overflow Vulnerability

CVE-2026-15693 Overview

CVE-2026-15693 is a stack-based buffer overflow vulnerability affecting the Tenda BE12 Pro router firmware version 16.03.66.23. The flaw resides in the fromSafeMacFilter function within the /goform/SafeMacFilter endpoint. Attackers can manipulate the page argument to overflow a fixed-size stack buffer, corrupting adjacent memory and control-flow structures. The vulnerability is remotely reachable over the network and requires only low-level privileges to exploit. Public disclosure of exploit details has occurred, increasing the likelihood of opportunistic attacks against exposed devices. The weakness is categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Successful exploitation of CVE-2026-15693 can lead to remote code execution or denial of service against affected Tenda BE12 Pro devices, compromising the integrity, confidentiality, and availability of the router.

Affected Products

Tenda BE12 Pro firmware 16.03.66.23
/goform/SafeMacFilter web management endpoint
fromSafeMacFilter handler function

Discovery Timeline

2026-07-14 - CVE-2026-15693 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15693

Vulnerability Analysis

The vulnerability exists in the HTTP request handler fromSafeMacFilter, which processes MAC address filtering configuration requests submitted to /goform/SafeMacFilter. The handler reads the page parameter from the incoming request and copies it into a fixed-size buffer allocated on the stack. No bounds check governs the length of the supplied value before the copy operation completes.

An authenticated attacker who can reach the router's web management interface can submit an oversized page value. The overflow writes past the destination buffer into adjacent stack memory, including saved registers and the return address. This condition matches the classic pattern described by CWE-119.

Root Cause

The root cause is missing input length validation on the page request parameter before it is copied into a stack-allocated buffer inside fromSafeMacFilter. The firmware trusts the client-supplied length and uses an unbounded string copy routine, allowing the buffer boundary to be crossed. Embedded MIPS/ARM binaries produced for the Tenda BE12 Pro line typically lack modern exploit mitigations such as stack canaries or full ASLR, which amplifies the impact.

Attack Vector

Exploitation occurs over the network against the router's HTTP management service. The attacker sends a crafted POST request to /goform/SafeMacFilter with an oversized page value. Because a public proof-of-concept exists, low-skill attackers can adapt the disclosed request to target internet-exposed or LAN-accessible devices. Successful memory corruption can crash the httpd process, disrupt routing, or, in weaponized variants, redirect execution to attacker-controlled shellcode.

A synthetic exploit is not reproduced here. Technical request structure is documented in the GitHub Issue Discussion and the VulDB Vulnerability Details.

Detection Methods for CVE-2026-15693

Indicators of Compromise

Unexpected crashes or reboots of the httpd process on Tenda BE12 Pro devices
HTTP POST requests to /goform/SafeMacFilter containing abnormally long page parameter values
Requests to /goform/SafeMacFilter originating from untrusted network segments or WAN sources
Loss of MAC filter configuration or unexplained changes to router firewall policy

Detection Strategies

Deploy network intrusion detection signatures that flag HTTP requests to /goform/SafeMacFilter where the page parameter exceeds a safe length threshold, such as 128 bytes.
Correlate router availability telemetry with inbound HTTP traffic to identify request patterns that precede management-plane outages.
Inspect web application firewall logs in front of any exposed router management interface for oversized query strings and repeated failures.

Monitoring Recommendations

Continuously monitor for unauthorized exposure of router management interfaces on WAN-facing IP addresses.
Enable syslog forwarding from the Tenda BE12 Pro to a centralized log platform and alert on httpd restart events.
Track configuration drift for MAC filter rules and administrative accounts on affected routers.

How to Mitigate CVE-2026-15693

Immediate Actions Required

Restrict access to the router web management interface to trusted management VLANs and hosts only.
Disable remote WAN administration on any Tenda BE12 Pro device running firmware 16.03.66.23.
Rotate administrator credentials to reduce the risk of low-privileged accounts being abused to reach the vulnerable endpoint.
Monitor the Tenda Official Website for a firmware release addressing CVE-2026-15693.

Patch Information

At the time of publication, no vendor-supplied patch is referenced in the NVD entry for CVE-2026-15693. Administrators should track the VulDB CVE-2026-15693 record and the Tenda Official Website for firmware updates. Until a fix is available, compensating controls are required.

Workarounds

Place affected routers behind an upstream firewall that blocks direct HTTP access to the management interface from untrusted networks.
Segment IoT and network infrastructure onto a dedicated VLAN to limit lateral reach if a device is compromised.
Where feasible, replace end-of-support consumer-grade routers with hardware that receives active security maintenance.

bash

# Example iptables rule to restrict router management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP