CVE-2026-1420
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC23 routers via a buffer overflow in the WifiExtraSet function. Attackers can exploit this without authentication by sending specially crafted requests to the vulnerable endpoint. All users running the affected firmware version are at risk.
💻 Affected Systems
- Tenda AC23 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router leading to persistent backdoor installation, network traffic interception, credential theft, and lateral movement to connected devices.
Likely Case
Router takeover enabling DNS hijacking, credential harvesting, and use as a pivot point for attacks on internal networks.
If Mitigated
Limited impact if the router is behind a firewall with strict inbound filtering and the web interface is not exposed to the internet.
🎯 Exploit Status
The PoC demonstrates reliable exploitation. The vulnerability requires no authentication and is straightforward to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: Yes
Instructions:
Check Tenda's official website or support portal for firmware updates. If available, download the latest firmware, upload it via the router's web interface, and reboot.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to the router's web interface by disabling remote management/WAN access features.
Restrict web interface access
allUse firewall rules to block inbound access to port 80/443 on the router from untrusted networks.
🧯 If You Can't Patch
- Segment the router on an isolated network VLAN to limit lateral movement potential.
- Monitor for unusual outbound connections or unexpected configuration changes on the router.
🔍 How to Verify
Check if Vulnerable:
Check the firmware version in the router's web interface under System Status or similar. If version is 16.03.07.52, the device is vulnerable.Check Version:
Connect to the router's web interface and navigate to System Status or use curl: curl -s http://router-ip/ | grep -i firmwareVerify Fix Applied:
After updating, verify the firmware version has changed from 16.03.07.52 to a newer version.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/WifiExtraSet with long wpapsk_crypto parameters
- Router reboot events or configuration changes not initiated by administrators
Network Indicators:
- Unexpected outbound connections from the router to unknown IPs
- DNS queries to suspicious domains from the router
SIEM Query:
source="router_logs" AND (uri_path="/goform/WifiExtraSet" AND content_length>1000)🔗 References
- https://github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow_WifiExtraSet/Tenda%20AC23_Buffer_Overflow_WifiExtraSet.md
- https://github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow_WifiExtraSet/Tenda%20AC23_Buffer_Overflow_WifiExtraSet.md#poc
- https://vuldb.com/?ctiid.342836
- https://vuldb.com/?id.342836
- https://vuldb.com/?submit.736559
- https://www.tenda.com.cn/
