CVE-2026-0640
📋 TL;DR
A buffer overflow vulnerability in Tenda AC23 routers allows remote attackers to execute arbitrary code by manipulating the Time parameter in the PowerSaveSet function. This affects users running firmware version 16.03.07.52. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Tenda AC23
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, and lateral movement to other devices.
Likely Case
Router takeover allowing attackers to modify DNS settings, intercept traffic, or launch attacks against internal network devices.
If Mitigated
Limited impact if device is behind firewall with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public proof-of-concept exploit available on GitHub demonstrates remote code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for AC23
3. Upload via router admin interface
4. Reboot router after update
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router administration interface
Access router admin panel > Advanced > System > Remote Management > Disable
Network segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected router with different model or vendor
- Place router behind dedicated firewall with strict inbound filtering
🔍 How to Verify
Check if Vulnerable:
Access router admin interface and check firmware version under System StatusCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than 16.03.07.52📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/PowerSaveSet
- Multiple failed buffer overflow attempts
Network Indicators:
- Unusual traffic patterns from router
- Router making unexpected outbound connections
SIEM Query:
source_ip=router_ip AND uri_path="/goform/PowerSaveSet" AND method="POST"🔗 References
- https://github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow/Tenda%20AC23_Buffer_Overflow.md
- https://github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow/Tenda%20AC23_Buffer_Overflow.md#poc
- https://vuldb.com/?ctiid.339683
- https://vuldb.com/?id.339683
- https://vuldb.com/?submit.731772
- https://www.tenda.com.cn/
