{"id":"CVE-2026-114268","kind":"vulnerability","aliases":["CVE-2026-114268"],"related":[],"title":"Tenda BE3L Pro router: remote buffer overflow in Wi-Fi setup takes control","description":"A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.","summary":"The Tenda BE3L Pro router firmware version 16.03.60.62 has a buffer overflow in the web handler formWifiBasicSet at /goform/WifiBasicSet, triggered by the security_5g argument. A remote attacker can send a crafted request to overflow memory, and a public exploit has been published.","severity":"critical","cvss":9.9,"epss":0.00511,"exploited":false,"exploited_at":null,"products":[{"name":"Tenda BE3L Pro","fixed":[],"affected":"= 16.03.60.62","ecosystem":"firmware"}],"ecosystems":["firmware"],"tags":["be3l-pro","buffer-overflow","home-network","infrastructure","poc-public","routers","tenda"],"not_affected_if":["different-firmware-version","web-admin-disabled-from-wan"],"how_to_check":"Check the firmware version under the router admin page or system info; 16.03.60.62 is affected.","fix":"No fixed version is named in the sources; check the Tenda support site for a newer firmware.","status":"open","published_at":"2026-10-21T19:17:00+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:54+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:32:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown\nNo fixed version is named in the sources; check the Tenda support site for a newer firmware.","reach":"internet","title":"Tenda BE3L Pro router: remote buffer overflow in Wi-Fi setup takes control","impact":"high","summary":"The Tenda BE3L Pro router firmware version 16.03.60.62 has a buffer overflow in the web handler formWifiBasicSet at /goform/WifiBasicSet, triggered by the security_5g argument. A remote attacker can send a crafted request to overflow memory, and a public exploit has been published.","category":"infrastructure","who_cares":["tenda","be3l-pro","home-network","routers"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs code on the router remotely and takes over the network","analyst_note":"Confirm the fixed firmware version and whether the admin interface needs login, via the Tenda vendor advisory and the NVD entry.","how_to_check":"Check the firmware version under the router admin page or system info; 16.03.60.62 is affected.\nunknown","needs_analyst":true,"not_affected_if":["different-firmware-version","web-admin-disabled-from-wan"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000527,"input_tokens":2985,"output_tokens":456,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check vendor advisory or NVD/CVE record for vendor fix version and whether the admin web interface is exposed by default; sources give no patched version or auth requirement.","search":"'-114268':17A,20A '-2026':16A,19A '/goform/wifibasicset':57B,103C '16.03.60.62':46B,91C '5g':62B,110C 'affect':92C 'argument':63B,108C 'attack':66B,120C 'be3l':2A,22A,25B,41B,89C 'be3l-pro':24B 'buffer':6A,28B,49B,112C 'buffer-overflow':27B 'caus':111C 'control':14A 'craft':70B 'cve':15A,18A 'exploit':78B,123C 'fi':11A 'file':102C 'firmwar':44B 'flaw':83C 'formwifibasicset':55B,99C 'found':86C 'function':98C 'handler':54B 'home':31B 'home-network':30B 'infrastructur':33B 'initi':118C 'manipul':105C 'may':128C 'memori':74B 'network':32B 'overflow':7A,29B,50B,73B,113C 'poc':35B 'poc-publ':34B 'possibl':116C 'pro':3A,23A,26B,42B,90C 'public':36B,77B 'publish':81B,126C 'remot':5A,65B,121C 'request':71B 'router':4A,37B,43B 'secur':61B,109C 'send':68B 'setup':12A 'take':13A 'tenda':1A,21A,38B,40B,88C 'trigger':58B 'use':130C 'version':45B 'vulner':95C 'web':53B 'wi':10A 'wi-fi':9A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T19:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114268","severity":null,"published_at":"2026-10-21T19:17:00+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114268:224","url":null,"severity":null,"published_at":"2026-10-23T22:26:16+00:00","modified_at":"2026-10-23T22:26:16+00:00","first_seen_at":"2026-10-23T22:26:16+00:00","fetched_at":"2026-10-23T22:26:16+00:00","note":"VulDB VDB-424700 (submitter tmzhou) confirms only 16.03.60.62 affected, remote, PoC on GitHub (link not shown publicly), no vendor patch or mitigation known. Tenda has no advisory I could find. Exploitation in the wild not reported. Auth: CVSS PR:L suggests a logged-in admin session is needed; not confirmed by a primary source. Not read: the PoC repo itself."},{"source":"epss","external_id":"CVE-2026-114268","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114268","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1436,"url":"https://vuldb.com/vuln/424700","title":"VulDB VDB-424700: Tenda BE3L Pro formWifiBasicSet security_5g overflow","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1437,"url":"https://github.com/CyberJ3ff/IOT/blob/main/tenda/tenda%20AC8%20v4%20V16.03.34.06/detail.md","title":"Related write-up: same WifiBasicSet security_5g overflow in Tenda AC8 v4","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}