# CVE-2026-114268: Tenda BE3L Pro buffer overflow in WifiBasicSet

Source: https://junglewise.ai/threats/cve-2026-114268-a-flaw-has-been-found-in-tenda-be3l-pro-16-03-60-62-affected-by  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114268 · Severity: critical · CVSS 9.9 · Published 2026-10-21

Tenda BE3L Pro is a wireless router used for network connectivity in homes and small offices. A buffer overflow vulnerability in its web management interface allows remote attackers to crash the device or execute arbitrary code without authentication, potentially giving an attacker complete control of the router and access to all network traffic.

Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-114268 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114268 being exploited in the wild.

**How severe is CVE-2026-114268?** Critical severity, with a CVSS score of 9.9, published 21 October 2026.

**Which products and versions are affected?** Tenda BE3L Pro 16.03.60.62.

**Is there a fix for CVE-2026-114268?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-114268 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-114268?** Check whether you run Tenda BE3L Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overflow exists in the formWifiBasicSet() function of the /goform/WifiBasicSet endpoint, where the security_5g POST parameter is processed via strcpy() into a 256-byte fixed buffer without bounds checking. An unauthenticated remote attacker can send an oversized POST request to trigger memory corruption, stack manipulation, and arbitrary code execution. A public proof-of-concept exploit is available.

## Affected products

- Tenda BE3L Pro 16.03.60.62

## Timeline

- 2026-10-21: disclosed
- other: Public exploit code published on GitHub

## References

- [https://github.com/Tmzop/Tenda-CVE](https://github.com/Tmzop/Tenda-CVE)
- [https://vuldb.com/cve/CVE-2026-114268](https://vuldb.com/cve/CVE-2026-114268)