Submit #1018994: Tenda Tenda Router BE3L Pro V16.03.60.62 Stack-based Buffer Overflow

During the security assessment of the application, a critical buffer overflow vulnerability was identified in the /goform/WifiBasicSet endpoint. The vulnerability stems from the formWifiBasicSet() function, This function retrieves the security_5g parameter from a POST request.The strcpy function does not check the size of the target buffer when processing the security_5g parameter. Since *s1 is limited to 256 bytes, providing input larger than this size can overwrite adjacent memory. This flaw can lead to application crashes, memory corruption, or arbitrary code execution. The vulnerability introduces serious risks to device stability, data confidentiality, and overall system security, and requires immediate remediation to prevent potential exploitation.

A buffer overflow vulnerability was identified within the " /goform/WifiBasicSet" endpoint of the application. The root cause lies in the fact that the formWifiBasicSet() function processesThis function retrieves the security_5g parameter from a POST request.The strcpy function does not check the size of the target buffer when processing the security_5g parameter . Since *s1 is allocated with a fixed size of 256 bytes, supplying an excessively large page value can overwrite adjacent memory. This unsafe use of strcpy allows attackers to trigger memory corruption, manipulate program execution, or cause application crashes.

An attacker can exploit this vulnerability to achieve various malicious outcomes, including:
- Denial of Service (DoS): Crashing the web server process and making the device's management interface inaccessible.
- Arbitrary Code Execution: Overwriting the return address on the stack to redirect program execution to shellcode, potentially allowing the attacker to gain full control over the device.
- Information Leakage: Exposing sensitive information from the device's memory.

Successful exploitation could allow an attacker to take over the router, monitor network traffic, or use it as a pivot point to attack other devices on the network.

• Source: ⚠️ https://github.com/Tmzop/Tenda-CVE
• User: tmzhou (UID 101985)
• Submission: 10/07/2026 20:58 (14 days ago)
• Moderation: 10/21/2026 08:56 (13 days later)
• Status: Accepted
• VulDB entry: 424700 [Tenda BE3L Pro 16.03.60.62 /goform/WifiBasicSet formWifiBasicSet security_5g buffer overflow]
• Points: 20