CVE-2025-15216

A flaw has been found in Tenda AC23 16.03.07.52. It impacts an unknown function of the file /goform/WifiExtraSet. Manipulation of the argument wpapsk_crypto causes buffer overflow. Remote exploitation is possible, and the exploit has been published and may be used.

A vulnerability has been identified in Tenda AC23 firmware version 16.03.07.52, affecting the sscanf function in the /goform/PowerSaveSet file. Manipulation of the Time argument can lead to a buffer overflow. The attack can be launched remotely, and the exploit is publicly available.

Tenda AC23 version Vv16.03.07.45_cn is vulnerable to buffer overflow in the sub_450A4C function.

A buffer overflow vulnerability was discovered in the Tenda AC23 router firmware version v16.03.07.44 in the fromAdvSetMacMtuWan function. An attacker could exploit this flaw to execute arbitrary code or cause a denial of service.

A stack overflow vulnerability was discovered in the Tenda AC23 router running firmware version v16.03.07.44. This allows a remote attacker to execute arbitrary code on the device.

A buffer overflow vulnerability exists in Tenda AC23 up to version 16.03.07.52 in the sscanf function of /goform/SetStaticRouteCfg. Manipulation of the list argument allows remote attacks, and the exploit has been publicly disclosed.

In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability.

In Tenda AC23 v16.03.07.45_cn, the sub_4781A4 function does not validate the parameters entered by the user, resulting in a post-authentication stack overflow vulnerability.

The get_parentControl_list_Info function does not verify the parameters entered by the user, leading to a post-authentication heap overflow vulnerability in Tenda AC23 v16.03.07.45_cn.

The sub_451784 function does not validate the parameters entered by the user, resulting in a stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn.