Tenda AC23 HTTP POST Request SetPptpServerCfg sscanf buffer overflow

8.7 CVSS

Vulnerability Description

A vulnerability has been found in Tenda AC23 up to 16.03.07.52. Affected by this vulnerability is the function sscanf of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-10803

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

QMSSDXN (VulDB User)

References

More from Tenda

View All →

CVE-2025-9828

Tenda CP6 uhttp sub_2B7D04 risky encryption

Medium 6.3

CVE-2025-9813

Tenda CH22 SetSambaConf formSetSambaConf buffer overflow

High 8.7

CVE-2025-9812

Tenda CH22 exeCommand formexeCommand buffer overflow

High 8.7

CVE-2025-9806

Tenda F1202 Administrative shadow hard-coded credentials

Low 1.8

CVE-2025-9791

Tenda AC20 fromAdvSetMacMtuWan stack-based overflow

High 8.7

Affected Vendor

Tenda

View all reports →

Affected Software

AC23

Vulnerable Versions:

16.03.07.0, 16.03.07.1, 16.03.07.2, 16.03.07.3, 16.03.07.4, 16.03.07.5, 16.03.07.6, 16.03.07.7, 16.03.07.8, 16.03.07.9, 16.03.07.10, 16.03.07.11, 16.03.07.12, 16.03.07.13, 16.03.07.14, 16.03.07.15, 16.03.07.16, 16.03.07.17, 16.03.07.18, 16.03.07.19, 16.03.07.20, 16.03.07.21, 16.03.07.22, 16.03.07.23, 16.03.07.24, 16.03.07.25, 16.03.07.26, 16.03.07.27, 16.03.07.28, 16.03.07.29, 16.03.07.30, 16.03.07.31, 16.03.07.32, 16.03.07.33, 16.03.07.34, 16.03.07.35, 16.03.07.36, 16.03.07.37, 16.03.07.38, 16.03.07.39, 16.03.07.40, 16.03.07.41, 16.03.07.42, 16.03.07.43, 16.03.07.44, 16.03.07.45, 16.03.07.46, 16.03.07.47, 16.03.07.48, 16.03.07.49, 16.03.07.50, 16.03.07.51, 16.03.07.52