by Kastro
Paper/Archive/CVE-2026-0640

CVE-2026-0640

Tenda AC23 — Tenda AC23 PowerSaveSet sscanf buffer overflow

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 89.1.891 × 2017.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A weakness has been identified in Tenda AC23 16.03.07.52. This affects the function sscanf of the file /goform/PowerSaveSet. Executing a manipulation of the argument Time can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

Affected

ProductAffectedFixed inSource
AC2316.03.07.52–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

writeupvuldb.com/?id.339683refvuldb.com/?ctiid.339683writeupvuldb.com/?submit.731772exploitgithub.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow/Tenda%20AC23_Buffer_Overflow.mdexploitgithub.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow/Tenda%20AC23_Buffer_Overflow.md#pocreftenda.com.cn