CVE-2026-0640CWE-119CWE-120

Tenda AC23 PowerSaveSet sscanf buffer overflow

High · published January 6, 2026

CVSS v4.0
8.7
EPSS
3%
Percentile
89.0
In the wild
Unconfirmed
What it is

⚡ A crafty buffer overflow lurks in Tenda AC23! Attackers can exploit this through a remote maneuver, turning the argument Time into a weapon! 🔥 Think of it like an overcrowded concert venue where the entrance has no security check — just one wrong move can cause the whole place to crumble under pressure, allowing unwanted guests to enter. 🎤 If exploited, this vulnerability could allow an attacker to crash the device, potentially gaining access to sensitive data or disrupting network services. Imagine a hacker turning your cozy home network into a chaotic mess — absolutely devastating! 🤯

Put simply

Think of it like an overcrowded concert venue where the entrance has no security check — just one wrong move can cause the whole place to crumble under pressure, allowing unwanted guests to enter. 🎤 This buffer overflow occurs in the sscanf function of the PowerSaveSet file, where manipulating the Time argument can overflow the buffer. This means attackers can execute arbitrary code remotely, leading to unauthorized actions on the device.

What to do

If exploited, this vulnerability could allow an attacker to crash the device, potentially gaining access to sensitive data or disrupting network services. Imagine a hacker turning your cozy home network into a chaotic mess — absolutely devastating! 🤯 To safeguard against this, patch your Tenda AC23 to version 16.03.08.52 or later immediately! Regularly check for firmware updates and consider limiting external access to your network. 🛡️ You've got this! Stay vigilant and follow these steps to lock down your network like a pro! 💪✨

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.03476 · 89.0th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2026-01-06T15:32Z
EPSS history
Timeline
  • 06 JAN 15:32Z
    Tenda AC23 PowerSaveSet sscanf buffer overflow
    cvelistv5