CVE-2026-15695 Overview
CVE-2026-15695 is a stack-based buffer overflow vulnerability in the Tenda BE12 Pro router running firmware version 16.03.66.23. The flaw resides in the fromDhcpListClient function within the /goform/DhcpListClient endpoint. Attackers can manipulate the page argument to overflow a stack buffer and corrupt adjacent memory. The vulnerability is exploitable remotely across the network and requires only low-privileged access. A public exploit has been disclosed, increasing the likelihood of opportunistic attacks against exposed devices. The weakness is tracked under CWE-119 for improper restriction of operations within the bounds of a memory buffer.
Critical Impact
Remote attackers with low-privileged access can trigger a stack-based buffer overflow in the Tenda BE12 Pro web management interface, potentially leading to arbitrary code execution or device compromise.
Affected Products
- Tenda BE12 Pro firmware version 16.03.66.23
- Web management interface endpoint /goform/DhcpListClient
- Devices exposing the router administration service to untrusted networks
Discovery Timeline
- 2026-07-14 - CVE-2026-15695 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-15695
Vulnerability Analysis
The vulnerability exists in the fromDhcpListClient function that handles requests to the /goform/DhcpListClient endpoint in the Tenda BE12 Pro router firmware. This endpoint is part of the web-based administration interface used to manage DHCP client lists. The function accepts a page parameter from HTTP requests and copies its value into a fixed-size stack buffer without proper length validation. When an attacker supplies an oversized page argument, the copy operation writes past the buffer boundary and corrupts adjacent stack memory, including saved return addresses. This condition is classified under [CWE-119], improper restriction of operations within the bounds of a memory buffer.
Root Cause
The root cause is missing bounds checking on user-controlled input before it is written to a stack-allocated buffer. Embedded router firmware frequently relies on unsafe string handling routines such as strcpy or sprintf in CGI-style handlers. In this case, the page argument flows directly from the HTTP request into the stack frame of fromDhcpListClient without size validation.
Attack Vector
An attacker can craft an HTTP request targeting /goform/DhcpListClient with an oversized page parameter. The request is delivered over the network to the router's management interface. Successful exploitation requires low-privileged authentication to the device. On successful overflow, the attacker can overwrite the saved return address and redirect execution flow, potentially achieving arbitrary code execution on the embedded system.
No verified proof-of-concept code is republished here. Technical details are available in the VulDB Vulnerability Detail and the GitHub Issue Discussion.
Detection Methods for CVE-2026-15695
Indicators of Compromise
- HTTP POST or GET requests to /goform/DhcpListClient containing abnormally long page parameter values
- Unexpected reboots, crashes, or watchdog resets on Tenda BE12 Pro devices
- Outbound connections from the router to unknown hosts following administrative traffic
- New or modified accounts on the router management interface
Detection Strategies
- Inspect web server and router syslog entries for malformed requests targeting the /goform/ handlers
- Deploy network intrusion detection signatures that flag oversized query parameters against router management endpoints
- Baseline normal HTTP request sizes to the router web interface and alert on outliers
Monitoring Recommendations
- Forward router logs to a centralized SIEM or data lake for correlation with authentication and network flow events
- Monitor for HTTP requests to /goform/DhcpListClient originating from outside the trusted management network
- Track firmware version inventory across deployed Tenda devices to identify unpatched systems
How to Mitigate CVE-2026-15695
Immediate Actions Required
- Restrict access to the router management interface to trusted administrative networks only
- Disable remote WAN-side administration on Tenda BE12 Pro devices
- Rotate administrative credentials to reduce the value of low-privileged access required for exploitation
- Review router logs for evidence of exploitation attempts against /goform/DhcpListClient
Patch Information
No vendor patch has been published in the referenced advisory sources at the time of writing. Consult the Tenda Company Homepage and the VulDB CVE Report for updated firmware releases. Apply firmware updates as soon as the vendor releases a fixed version.
Workarounds
- Place affected routers behind a segmented management VLAN accessible only to authorized administrators
- Block inbound HTTP and HTTPS traffic to the router management port from untrusted networks using upstream firewall rules
- Replace end-of-support or unpatched Tenda BE12 Pro devices with supported hardware where a vendor fix is not forthcoming
- Enable account lockout and strong password policies to slow credential-based access to the management interface
# Configuration example: block external access to router management interface
# Example iptables rule on an upstream gateway
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <trusted_mgmt_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <trusted_mgmt_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
