CVE-2025-11356
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A buffer overflow vulnerability exists in Tenda AC23 up to version 16.03.07.52 in the sscanf function of /goform/SetStaticRouteCfg. Manipulation of the list argument allows remote attacks, and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker can exploit the buffer overflow to execute code or destabilize the device. The public availability of the exploit increases the risk.
Recommendation
Update the Tenda AC23 firmware to the latest version or restrict access to the management interface. Monitor the vendor for patches.
Other vulnerabilities in Tenda AC23
See all- CVE-2026-1420High
A flaw has been found in Tenda AC23 16.03.07.52. It impacts an unknown function of the file /goform/WifiExtraSet. Manipulation of the argument wpapsk_crypto causes buffer overflow. Remote exploitation is possible, and the exploit has been published and may be used.
- CVE-2026-0640High
A vulnerability has been identified in Tenda AC23 firmware version 16.03.07.52, affecting the sscanf function in the /goform/PowerSaveSet file. Manipulation of the Time argument can lead to a buffer overflow. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2023-40799Critical
Tenda AC23 version Vv16.03.07.45_cn is vulnerable to buffer overflow in the sub_450A4C function.
- CVE-2022-32386Critical
A buffer overflow vulnerability was discovered in the Tenda AC23 router firmware version v16.03.07.44 in the fromAdvSetMacMtuWan function. An attacker could exploit this flaw to execute arbitrary code or cause a denial of service.
- CVE-2022-32385Critical
A stack overflow vulnerability was discovered in the Tenda AC23 router running firmware version v16.03.07.44. This allows a remote attacker to execute arbitrary code on the device.
- CVE-2025-15216High
A vulnerability was identified in Tenda AC23 16.03.07.52. This impacts the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such manipulation of the argument bindnum leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
- CVE-2023-40798High
In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability.
- CVE-2023-40797High
In Tenda AC23 v16.03.07.45_cn, the sub_4781A4 function does not validate the parameters entered by the user, resulting in a post-authentication stack overflow vulnerability.
- CVE-2023-40802Medium
The get_parentControl_list_Info function does not verify the parameters entered by the user, leading to a post-authentication heap overflow vulnerability in Tenda AC23 v16.03.07.45_cn.
- CVE-2023-40801High
The sub_451784 function does not validate the parameters entered by the user, resulting in a stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn.
Original NVD description (English source)
A vulnerability was found in Tenda AC23 up to 16.03.07.52. Affected by this issue is the function sscanf of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS