CVE-2026-15694 is a high-severity stack-based buffer overflow vulnerability affecting Tenda BE12 Pro firmware version 16.03.66.23. The vulnerability arises from improper input validation in the fromSetIpBind function of the /goform/SetIpBind endpoint, allowing remote attackers to cause a buffer overflow by manipulating the 'page' argument. This can lead to potential arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. Exploit code is publicly available, increasing the risk of exploitation. No official fix or patch has been disclosed by the vendor as of the publication date.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected device, compromising confidentiality, integrity, and availability. Since the exploit is publicly available and the attack can be launched remotely without authentication or user interaction, affected devices are at significant risk.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisories for updates and consider applying any future firmware updates that address this issue. Until a fix is released, restricting remote access to the affected device's management interface and employing network-level protections may reduce exposure.