CVE-2023-40798
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability.
Risk Assessment
This vulnerability could be exploited by an attacker to execute malicious code, posing a serious security threat to the system.
Recommendation
It is recommended to update the device to the latest firmware version that addresses this vulnerability and to implement additional input validation mechanisms.
Other vulnerabilities in Tenda AC23 v16.03.07.45_cn
See all- CVE-2026-1420High
A flaw has been found in Tenda AC23 16.03.07.52. It impacts an unknown function of the file /goform/WifiExtraSet. Manipulation of the argument wpapsk_crypto causes buffer overflow. Remote exploitation is possible, and the exploit has been published and may be used.
- CVE-2026-0640High
A vulnerability has been identified in Tenda AC23 firmware version 16.03.07.52, affecting the sscanf function in the /goform/PowerSaveSet file. Manipulation of the Time argument can lead to a buffer overflow. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2023-40799Critical
Tenda AC23 version Vv16.03.07.45_cn is vulnerable to buffer overflow in the sub_450A4C function.
- CVE-2022-32386Critical
A buffer overflow vulnerability was discovered in the Tenda AC23 router firmware version v16.03.07.44 in the fromAdvSetMacMtuWan function. An attacker could exploit this flaw to execute arbitrary code or cause a denial of service.
- CVE-2022-32385Critical
A stack overflow vulnerability was discovered in the Tenda AC23 router running firmware version v16.03.07.44. This allows a remote attacker to execute arbitrary code on the device.
- CVE-2023-40797High
In Tenda AC23 v16.03.07.45_cn, the sub_4781A4 function does not validate the parameters entered by the user, resulting in a post-authentication stack overflow vulnerability.
- CVE-2023-40802Medium
The get_parentControl_list_Info function does not verify the parameters entered by the user, leading to a post-authentication heap overflow vulnerability in Tenda AC23 v16.03.07.45_cn.
- CVE-2023-40801High
The sub_451784 function does not validate the parameters entered by the user, resulting in a stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn.
- CVE-2023-40800High
The compare_parentcontrol_time function does not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn.
- CVE-2022-32384High
A stack overflow vulnerability was discovered in Tenda AC23 router firmware v16.03.07.44. It occurs in the formWifiBasicSet function via the security_5g parameter.
Original NVD description (English source)
In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability.