CVE-2026-15696 is a stack-based buffer overflow vulnerability affecting Tenda BE12 Pro firmware version 16.03.66.23. The issue arises from unsafe manipulation of the 'page' argument in the fromVirtualSer function located in the /goform/VirtualSer endpoint. An attacker can remotely trigger this flaw to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service. Exploit code has been publicly disclosed, increasing the risk of exploitation. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected device. Given the high CVSS score (8.7) and the availability of public exploit code, the risk to unpatched devices is significant. The vulnerability requires no user interaction and can be triggered remotely, increasing its severity.

No official patch or remediation has been confirmed or provided by the vendor at this time. Users should monitor the vendor's advisories for updates. Until a fix is available, consider limiting network exposure of the affected device, such as restricting remote access to trusted networks only. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.