CVE-2026-1420
HighSummary
A flaw has been found in Tenda AC23 16.03.07.52. It impacts an unknown function of the file /goform/WifiExtraSet. Manipulation of the argument wpapsk_crypto causes buffer overflow. Remote exploitation is possible, and the exploit has been published and may be used.
Risk Assessment
A remote attacker can exploit the buffer overflow, potentially leading to device compromise or denial of service.
Recommendation
Apply available patches or restrict access to the device from trusted networks.
Other vulnerabilities in Tenda AC23
See all- CVE-2026-0640High
A vulnerability has been identified in Tenda AC23 firmware version 16.03.07.52, affecting the sscanf function in the /goform/PowerSaveSet file. Manipulation of the Time argument can lead to a buffer overflow. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2023-40799Critical
Tenda AC23 version Vv16.03.07.45_cn is vulnerable to buffer overflow in the sub_450A4C function.
- CVE-2022-32386Critical
A buffer overflow vulnerability was discovered in the Tenda AC23 router firmware version v16.03.07.44 in the fromAdvSetMacMtuWan function. An attacker could exploit this flaw to execute arbitrary code or cause a denial of service.
- CVE-2022-32385Critical
A stack overflow vulnerability was discovered in the Tenda AC23 router running firmware version v16.03.07.44. This allows a remote attacker to execute arbitrary code on the device.
- CVE-2023-40798High
In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability.
- CVE-2023-40797High
In Tenda AC23 v16.03.07.45_cn, the sub_4781A4 function does not validate the parameters entered by the user, resulting in a post-authentication stack overflow vulnerability.
- CVE-2023-40802Medium
The get_parentControl_list_Info function does not verify the parameters entered by the user, leading to a post-authentication heap overflow vulnerability in Tenda AC23 v16.03.07.45_cn.
- CVE-2023-40801High
The sub_451784 function does not validate the parameters entered by the user, resulting in a stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn.
- CVE-2023-40800High
The compare_parentcontrol_time function does not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn.
- CVE-2022-32384High
A stack overflow vulnerability was discovered in Tenda AC23 router firmware v16.03.07.44. It occurs in the formWifiBasicSet function via the security_5g parameter.
Original NVD description (English source)
A flaw has been found in Tenda AC23 16.03.07.52. This impacts an unknown function of the file /goform/WifiExtraSet. This manipulation of the argument wpapsk_crypto causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.