A security vulnerability disclosed on October 21, 2026 has been found in Tenda’s BE3L Pro router. The vulnerability, assigned CVE-2026-114268, affects the device’s software version 16.03.60.62. The exploit code (PoC) is public, and the manufacturer has not yet announced a patch.
Where is the vulnerability?
The issue is in the function running at the /goform/WifiBasicSet address in the device’s web interface: the formWifiBasicSet function. This function copies the value coming from the security_5g parameter into a fixed-size buffer when saving wireless network settings, without performing a length check. The result is a stack-based buffer overflow classified as CWE-120.
According to the VulDB record, the attack can be launched over the network. The CVSS 3.1 vector indicates that the attacker needs a low-privilege account logged into the device; in other words, someone with access to the management interface can corrupt the device’s memory with a crafted request. The vulnerability’s CVSS 3.1 base score is 9.9, and its CVSS 4.0 score is 8.6.
Why should this be taken seriously?
A buffer overflow, when carefully crafted, can lead not only to a device crash but also to changing the execution flow in memory. On a home network, this could mean monitoring traffic flowing through the router or opening a door to pivot to other devices on the local network. Routers are therefore considered the most critical part of a home network: even if the device itself is secure, if the gateway is compromised, the entire connection chain is affected.
Two factors make the risk bigger: the exploit code has been published on GitHub, and VulDB rates the exploit as ‘easy’. In contrast, the record does not list any defined countermeasure or patch information from the manufacturer; the vendor status is marked as ‘undefined’. As a precaution, VulDB recommends replacing the affected device with an alternative.
What can users do?
First, make sure the device’s management interface is not accessible from the internet. Remote management should be disabled in the Tenda interface; the router’s management port should not be exposed through modem port forwarding. Since the vulnerability is triggered through a logged-in account, it is also important that the default administrator password has been changed.
The second step is to follow the manufacturer’s software update. Check Tenda’s support page to see whether a new firmware has been released for the BE3L Pro; when the update arrives, apply it by restarting the device. If no patch is released for a long time, replacing the device or reducing its internet-facing surface is a reasonable option because of this critical-scored vulnerability.
Source: VulDB · NVD
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.