CVE-2026-15695 is a stack-based buffer overflow vulnerability affecting Tenda BE12 Pro version 16.03.66.23. The issue arises from improper handling of the page argument in the fromDhcpListClient function located in /goform/DhcpListClient. This flaw allows a remote attacker to cause a buffer overflow on the stack, potentially leading to code execution or denial of service. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is published with no official remediation or patch available at this time.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. The vulnerability does not require user interaction or privileges, increasing its risk. However, there are no confirmed reports of exploitation in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting network exposure of the affected device and monitoring for suspicious activity related to DHCP client list requests targeting the /goform/DhcpListClient endpoint.