CVE-2026-0640
Published: 06 January 2026
Description
A weakness has been identified in Tenda AC23 16.03.07.52. This affects the function sscanf of the file /goform/PowerSaveSet. Executing a manipulation of the argument Time can lead to buffer overflow. The attack can be launched remotely. The exploit has been…
more
made available to the public and could be used for attacks.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents buffer overflow by validating the 'Time' argument manipulated in the sscanf function of /goform/PowerSaveSet.
Implements memory protections such as ASLR and stack canaries to block unauthorized code execution from the buffer overflow vulnerability.
Requires identification, reporting, and correction of the buffer overflow flaw in Tenda AC23 firmware version 16.03.07.52.
Security SummaryAI
CVE-2026-0640 is a buffer overflow vulnerability affecting Tenda AC23 router firmware version 16.03.07.52. The flaw exists in the sscanf function within the /goform/PowerSaveSet file, where manipulation of the Time argument triggers the overflow. Published on 2026-01-06, it is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
The vulnerability enables remote exploitation by attackers with low privileges (PR:L), requiring no user interaction (UI:N) and low attack complexity (AC:L) over the network (AV:N). Successful exploitation can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), with a CVSS v3.1 base score of 8.8, potentially allowing arbitrary code execution without changing the security scope (S:U).
Proof-of-concept exploits are publicly available on GitHub, including detailed reproduction steps for the Tenda AC23 buffer overflow. VulDB advisories (CTI ID 339683, ID 339683) document the issue and its submission, but no vendor patches or specific mitigations are referenced in the available sources. Security practitioners should isolate affected devices and monitor for exploitation attempts given the public POC.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a buffer overflow in a public-facing web interface (/goform/PowerSaveSet) on a router, enabling remote arbitrary code execution, directly mapping to T1190: Exploit Public-Facing Application.