Key points
- The vulnerability affects Tenda BE3L Pro firmware version 16.03.60.62.
- The National Vulnerability Database rates the flaw as critical with a CVSS score of 9.4.
- Publicly available exploit code enables remote manipulation of the WifiBasicSet function.
Security researchers have identified a severe vulnerability in the Tenda BE3L Pro router that allows remote attackers to initiate an attack. The flaw resides in the formWifiBasicSet function within the /goform/WifiBasicSet file. Attackers can trigger a buffer overflow by manipulating the security_5g argument. This specific input handling error enables remote initiation of the attack. The National Vulnerability Database notes that the exploit has been published and may be used.
By the numbers
- CVSS 9.4: The critical severity score assigned by the National Vulnerability Database for this vulnerability.
- 16.03.60.62: The specific firmware version of the Tenda BE3L Pro affected by the buffer overflow flaw.
- CWE-120: The Common Weakness Enumeration identifier for the buffer overflow weakness cited in the advisory.
What the figures mean
The high severity rating reflects the critical nature of the buffer overflow vulnerability. The National Vulnerability Database lists two severity assessments for CVE-2026-114268, with the higher score emphasizing the critical risk. The presence of publicly available exploit code significantly increases the likelihood of automated attacks. Security teams must treat this as an immediate threat because the attack can be initiated remotely. The specific targeting of the security_5g argument is the mechanism for the buffer overflow.
What to watch
Network defenders should monitor for unusual traffic patterns directed at the /goform/WifiBasicSet endpoint. The availability of public exploit scripts means threat actors may begin scanning for vulnerable Tenda devices immediately. Analysts should look for malformed HTTP requests containing large or unexpected values in the security_5g parameter. Such activity often precedes an attempt to trigger the buffer overflow. Continuous monitoring of router logs can reveal early signs of exploitation attempts before full compromise occurs.
Infection and persistence in general
Teams usually detect such router vulnerabilities through passive network monitoring or vulnerability scanners. Once an attacker gains initial access, they often install backdoors or modify firmware to maintain persistence. Analysts should examine running processes and network connections for unauthorized activity. Checking for modified configuration files is essential to identify persistent threats. Security operations centers typically correlate alerts from multiple sources to confirm active exploitation. Regular firmware updates remain the primary defense against these remote code execution vectors.
What to do and how to stay safe: Tenda
- Verify if your network uses Tenda BE3L Pro routers running firmware version 16.03.60.62.
- Isolate affected devices from the internet until a vendor patch is confirmed available.
- Monitor network logs for suspicious requests targeting the WifiBasicSet endpoint.
- Review router configurations for any unauthorized changes to 5GHz security settings.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Tenda router model is affected by CVE-2026-114268?
The Tenda BE3L Pro router running firmware version 16.03.60.62 is affected by this vulnerability.
What is the severity rating of this buffer overflow flaw?
The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.4.
Is there a public exploit for this vulnerability?
Yes, exploit code has been published and may be used by attackers to initiate remote attacks.
