The Tenda BE12 Pro router firmware version 16.03.66.23 contains a stack-based buffer overflow vulnerability in the fromDhcpListClient function of the /goform/DhcpListClient component. The vulnerability arises from improper manipulation of the 'page' argument, allowing an attacker to overflow the stack buffer remotely. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low complexity, no privileges required, and no user interaction needed. Exploit code has been published, but no known exploits in the wild have been reported. No official patch or remediation level has been disclosed by the vendor.

Successful exploitation of this vulnerability could allow a remote attacker to cause a stack-based buffer overflow on the affected device, potentially leading to denial of service or arbitrary code execution. The attack can be performed remotely over the network without user interaction and requires low privileges, increasing the risk of exploitation. However, no confirmed active exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interfaces and monitor for suspicious activity related to the /goform/DhcpListClient endpoint. Avoid exposing the device management interface to untrusted networks.