CVE-2026-15692 is a stack-based buffer overflow vulnerability affecting Tenda BE12 Pro firmware version 16.03.66.23. The vulnerability arises from improper handling of the 'page' argument in the fromSafeUrlFilter function located in /goform/SafeUrlFilter. An attacker can remotely exploit this flaw to cause a buffer overflow on the stack, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly known, but no official patch or fix has been disclosed by the vendor as of the publication date.

Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code or cause a denial of service on the affected device. The attack can be performed remotely without user interaction and requires only low privileges, increasing the risk of exploitation. The vulnerability affects the stability and security of the Tenda BE12 Pro device running the specified firmware version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit exposure of the affected device to untrusted networks and monitor for any unusual behavior. Avoid sending untrusted input to the vulnerable function if possible.