CVE-2026-15693 in BE12 Pro
Summary
by MITRE • 07/14/2026
A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23. This issue affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/14/2026
The security vulnerability identified in Tenda BE12 Pro router firmware version 16.03.66.23 represents a critical stack-based buffer overflow condition within the web interface administration functionality. This flaw resides in the SafeMacFilter function located at /goform/SafeMacFilter within the device's web server implementation, making it accessible through the standard HTTP interface that administrators and users typically interact with. The vulnerability specifically manifests when processing the page argument parameter, which suggests that the device fails to properly validate or sanitize input data before using it in memory operations. This particular implementation flaw creates an exploitable condition where attacker-controlled data can overwrite adjacent memory locations on the stack, potentially leading to arbitrary code execution or system compromise.
The technical nature of this vulnerability aligns with CWE-121 Stack-based Buffer Overflow, which occurs when a program writes more data to a fixed-length buffer than it can accommodate, causing adjacent memory to be overwritten. The attack vector is particularly concerning as it enables remote exploitation without requiring physical access or authentication credentials, making it a significant threat to network security. The fact that exploitation has been publicly disclosed increases the risk profile substantially, as malicious actors can readily develop and deploy automated tools to target vulnerable devices across networks. This vulnerability essentially provides attackers with a pathway to execute arbitrary code on the affected device, potentially enabling them to gain full administrative control over the router's operations.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass complete network compromise and potential data exfiltration capabilities. Once successfully exploited, an attacker could modify network configuration settings, redirect traffic through malicious proxies, establish persistent backdoors, or use the compromised device as a launch point for further attacks against internal networks. The router's role as a central networking component means that successful exploitation could provide attackers with visibility into all network traffic passing through the device, creating potential for widespread surveillance and man-in-the-middle attacks. Additionally, the compromised device could be used to relay malware or conduct distributed denial-of-service attacks against external targets.
Mitigation strategies must prioritize immediate firmware updates from Tenda to address the identified buffer overflow vulnerability, as this represents the most effective protection against exploitation. Network administrators should implement strict access controls limiting administrative interface access to trusted networks only, while also deploying network monitoring solutions that can detect anomalous traffic patterns associated with exploitation attempts. The principle of least privilege should be applied by ensuring that only necessary services remain enabled on the device and that administrative interfaces are not exposed to untrusted networks. Organizations should also consider implementing intrusion detection systems specifically configured to identify exploitation attempts targeting web application vulnerabilities in network infrastructure devices. Regular vulnerability assessments and network scanning should be conducted to identify other potentially vulnerable devices within the network perimeter, as this represents a common attack vector that affects multiple vendors' networking equipment. The ATT&CK framework categorizes this type of vulnerability under T1210 Exploitation for Privilege Escalation and T1071.005 Application Layer Protocol DNS, highlighting the multi-faceted nature of threats associated with such vulnerabilities in network infrastructure devices.