Vulnerability Description
A weakness has been identified in Tenda AC23 16.03.07.52. This affects the function sscanf of the file /goform/PowerSaveSet. Executing a manipulation of the argument Time can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tenda | Ac23 Firmware | 16.03.07.52 |
| Tenda | Ac23 | - |
Related Weaknesses (CWE)
References
- https://github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow/Tenda%2ExploitThird Party Advisory
- https://github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow/Tenda%2ExploitThird Party Advisory
- https://vuldb.com/?ctiid.339683Permissions RequiredVDB Entry
- https://vuldb.com/?id.339683Third Party AdvisoryVDB Entry
- https://vuldb.com/?submit.731772Third Party AdvisoryVDB Entry
- https://www.tenda.com.cn/Product
FAQ
What is CVE-2026-0640?
CVE-2026-0640 is a vulnerability with a CVSS score of 8.8 (HIGH). A weakness has been identified in Tenda AC23 16.03.07.52. This affects the function sscanf of the file /goform/PowerSaveSet. Executing a manipulation of the argument Time can lead to buffer overflow. ...
How severe is CVE-2026-0640?
CVE-2026-0640 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-0640?
Check the references section above for vendor advisories and patch information. Affected products include: Tenda Ac23 Firmware, Tenda Ac23.