Stack Buffer Overflow in Tenda BE12 Pro Filter

Overview

A stack-based buffer overflow vulnerability has been identified in the Tenda BE12 Pro wireless router running firmware version 16.03.66.23. The flaw resides in the fromSafeClientFilter function, reachable through the /goform/SafeClientFilter HTTP endpoint. By supplying an oversized value for the page parameter in a crafted HTTP request, an attacker can overflow a fixed-size stack buffer, overwrite saved return addresses, and achieve arbitrary code execution in the context of the router’s web server process — which typically runs with root privileges on embedded Linux platforms of this class.

The vulnerability was identified through binary analysis of the router’s firmware and subsequently disclosed through public GitHub channels, where a proof-of-concept exploit has already been released. With a CVSS score of 8.8 (High), this is a network-exploitable issue that does not require local access. Depending on the router’s administrative interface exposure, this could be triggered from the local network segment or, in misconfigured deployments, directly from the internet.

Tenda routers are widely deployed in both residential and small-to-medium business environments. The BE12 Pro, positioned as a Wi-Fi 7 capable device, represents a relatively recent product line, making the firmware version at issue actively deployed at scale. Any organization using this device as a network edge or perimeter device should treat this as a critical operational risk.

Technical Analysis

The root cause is a classic unbounded string copy operation against a stack-allocated buffer in the fromSafeClientFilter function. Firmware for consumer-grade routers in this product category is predominantly written in C, and the web form handler functions follow a pattern of extracting HTTP POST or GET parameters using an internal utility — typically a wrapper around nvram_get or a similar key-value retrieval function — and then copying the result into a local stack buffer without validating length.

The vulnerable pattern reconstructed from binary analysis resembles the following:

// Vulnerable: fromSafeClientFilter in /goform/SafeClientFilter
int fromSafeClientFilter(struct HttpRequest *req) {
    char pageBuf[64];   // fixed-size stack allocation
    char filterBuf[128];
    const char *pageParam;

    // Retrieves the raw value of the "page" parameter from the HTTP request
    pageParam = getRequestParam(req, "page");

    if (pageParam != NULL) {
        // No length check — strcpy will overflow pageBuf if pageParam > 63 bytes
        strcpy(pageBuf, pageParam);
    }

    // Further processing using pageBuf...
    processFilterPage(pageBuf, filterBuf);
    return 0;
}

The critical failure is the unconditional strcpy(pageBuf, pageParam) call. With pageBuf allocated at 64 bytes on the stack, any page parameter value longer than 63 characters will begin overwriting adjacent stack memory. On MIPS-based or ARM-based embedded platforms typical to Tenda hardware, this means overwriting the saved $ra (return address) register value stored on the stack frame. Once the function returns, execution is redirected to an attacker-controlled address.

On devices without stack canaries (which is common in older firmware toolchains used by consumer router vendors) or without ASLR enabled for the main application binary, exploiting this class of bug is straightforward. The attacker sends a single HTTP request:

POST /goform/SafeClientFilter HTTP/1.1
Host: 192.168.0.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 512

page=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA[PAYLOAD]

By padding the page value to overflow the buffer and placing a ROP gadget address or a direct shellcode pointer at the correct offset, the attacker gains control of the program counter upon function return. Given the public availability of the exploit, this is no longer a theoretical attack path.

Impact

An unauthenticated remote attacker on the same network — or any network segment with HTTP access to the router’s management interface — can exploit this vulnerability to execute arbitrary code with root privileges. The practical consequences include:

• Full device compromise: The attacker can install persistent backdoors, modify DNS settings to perform traffic interception, or enroll the device in a botnet.
• Network pivoting: A compromised router provides a foothold for lateral movement into the internal network segments it services.
• Credential harvesting: Router processes often have access to stored Wi-Fi PSKs, PPPoE credentials, and VPN configuration secrets held in NVRAM.
• Denial of service: A malformed payload that does not cleanly redirect execution will crash the web server process, disrupting network management and potentially rebooting the device.

The CVSS 8.8 score reflects the network attack vector (AV:N), low attack complexity (AC:L), no required privileges (PR:N in many default configurations where the admin interface is accessible without authentication on LAN), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The public exploit release elevates the operational urgency significantly — weaponized tooling is already available to unsophisticated attackers.

How to Fix It

For end users and network administrators:

1. Check for firmware updates on the official Tenda support portal at https://www.tenda.com.cn/. If an updated firmware version addressing this CVE becomes available, apply it immediately through the router’s administration interface under System > Firmware Upgrade.
2. Restrict access to the management interface. If the router’s admin panel is accessible from the WAN interface, disable remote management immediately. This does not eliminate the attack surface from the LAN, but it substantially reduces exposure.
3. Segment the management interface onto a dedicated VLAN or management network with strict ACLs.

For Tenda’s development team — the correct fix:

The remediation requires replacing unbounded copy operations with length-checked alternatives throughout the firmware’s form handler codebase:

// Fixed: fromSafeClientFilter with bounds-checked copy
int fromSafeClientFilter(struct HttpRequest *req) {
    char pageBuf[64];
    char filterBuf[128];
    const char *pageParam;

    pageParam = getRequestParam(req, "page");

    if (pageParam != NULL) {
        // strncpy with explicit size limit; ensure null-termination
        strncpy(pageBuf, pageParam, sizeof(pageBuf) - 1);
        pageBuf[sizeof(pageBuf) - 1] = '\0';
    } else {
        pageBuf[0] = '\0';
    }

    processFilterPage(pageBuf, filterBuf);
    return 0;
}

Beyond this immediate fix, Tenda’s firmware build pipeline should enable stack canaries (-fstack-protector-strong), full RELRO, and NX/XN bit enforcement in the linker flags, and all form handler functions should be audited for the same pattern. A systematic grep for strcpy, sprintf, and gets across the handler codebase is the minimum required audit step.

Our Take

Stack-based buffer overflows in consumer router firmware are not a new problem — they are a persistent and embarrassing one. The pattern seen here, where a developer copies an HTTP parameter into a fixed stack buffer without any bounds check, represents a failure that has been well-understood since at least the late 1990s. The persistence of this class of bug in embedded device firmware in 2026 reflects structural issues: firmware toolchains that lag behind modern compiler security defaults, limited security testing in hardware product release cycles, and codebases that are often forked from legacy SDK reference implementations carrying the same vulnerabilities for years.

For enterprises running SAST and DAST programs, this case is a reminder that coverage cannot stop at application-layer software. Network edge devices — routers, firewalls, and access points — represent an attack surface that is frequently excluded from security assessments. Any organization operating Tenda or similar consumer-grade networking hardware in a business context should incorporate firmware analysis into their asset security review processes.

Detection with SAST

This vulnerability class maps to CWE-121: Stack-based Buffer Overflow, a subset of CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer. Offensive360’s SAST engine detects this pattern by performing taint analysis on externally-supplied input sources — in this context, HTTP parameter extraction functions such as getRequestParam, nvram_get, or equivalents — and tracking the flow of tainted data into sink functions known to perform unbounded writes: strcpy, strcat, sprintf, gets, scanf, and similar.

Specifically, the engine flags any data flow where:

1. A taint source originates from user-controlled input (network, HTTP, CGI parameters).
2. The tainted value is passed as the source argument to a length-unchecked copy function.
3. The destination is a stack-allocated fixed-size buffer.

For firmware binaries where source code is unavailable, Offensive360’s binary analysis module identifies the same pattern at the disassembly level by locating stack frame allocations followed by unguarded strcpy-equivalent PLT calls with register arguments traceable to HTTP input parsing routines. Custom rules targeting embedded CGI handler naming conventions (functions prefixed with from, set, or get operating on /goform/ endpoints) are part of the router firmware rule pack.

References

• https://github.com/cve-a/dexingzhiqing/issues/1
• https://vuldb.com/cve/CVE-2026-15691
• https://vuldb.com/submit/855999
• https://vuldb.com/vuln/378238
• https://vuldb.com/vuln/378238/cti
• https://www.tenda.com.cn/