CVE-2026-114268 is a remotely triggerable buffer overflow in the formWifiBasicSet handler of Tenda BE3L Pro firmware 16.03.60.62, and a public exploit has been released.
What Is It
CVE-2026-114268 is a memory-corruption flaw in the Tenda BE3L Pro. It sits in the formWifiBasicSet function, which handles requests to /goform/WifiBasicSet. A crafted security_5g argument causes a buffer overflow. The CNA, VulDB, classifies the weakness as CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-120 (classic buffer overflow).
NVD published the record on 2026-10-21. Its status is "Received," which means NVD has not finished its own analysis yet.
Why It Matters
VulDB rates the flaw CVSS 3.1 9.9 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H:
- An attacker can trigger it over the network.
- The attack is not complex and needs no user interaction.
- The attacker only needs low privileges.
- The impact can reach beyond the vulnerable component (scope changed).
- Confidentiality, integrity and availability impacts are all high.
The CVSS 4.0 score is 8.6 (High), and its exploit maturity is set to Proof-of-Concept. The CVSS 2.0 score is 9.0.
The advisory says the exploit "has been published and may be used," and a public GitHub repository is listed as a reference. CISA's KEV catalog does not list this CVE, so there is no KEV confirmation of active exploitation. Still, a public exploit for a network-reachable router bug makes real-world attacks more likely.
What's Vulnerable
- Vendor: Tenda
- Product: BE3L Pro
- Affected version: 16.03.60.62
- CPE:
cpe:2.3:h:tenda:be3l_pro:*:*:*:*:*:*:*:*
The source data names only firmware 16.03.60.62 as affected. It does not say whether other versions are affected.
Patch Status
The supplied records list no vendor patch, fixed firmware version or advisory. Because the CVE is not in KEV, there is also no CISA required action or remediation due date.
Until Tenda releases a fix, owners of BE3L Pro devices running 16.03.60.62 should:
- Check the vendor site for firmware updates.
- Limit who can reach the device's management interface.
- Keep a close eye on the device, given that a public exploit exists.