CVE-2026-0640: Tenda AC23 Buffer Overflow Vulnerability

CVE-2026-0640 Overview

A buffer overflow vulnerability has been identified in Tenda AC23 router firmware version 16.03.07.52. This vulnerability affects the sscanf function within the /goform/PowerSaveSet endpoint. By manipulating the Time argument, an attacker can trigger a buffer overflow condition. The attack can be launched remotely over the network, and proof-of-concept exploit code has been made publicly available.

Critical Impact

Remote attackers can exploit this buffer overflow to potentially execute arbitrary code, crash the device, or gain unauthorized control of the affected Tenda AC23 router without requiring user interaction.

Affected Products

• Tenda AC23 Router - Firmware version 16.03.07.52

Discovery Timeline

• January 6, 2026 - CVE-2026-0640 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-0640

Vulnerability Analysis

This vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw exists in the sscanf function implementation within the PowerSaveSet form handler on the Tenda AC23 router. The vulnerability allows remote authenticated attackers to overflow a buffer by sending specially crafted input to the Time parameter, potentially leading to arbitrary code execution or denial of service conditions on the affected device.

The network-accessible nature of this vulnerability makes it particularly concerning for IoT devices like routers, which often sit at network perimeters. Successful exploitation could allow an attacker to compromise the router and potentially pivot to other devices on the network.

Root Cause

The root cause of this vulnerability lies in the unsafe use of the sscanf function when processing user-supplied input from the Time argument. The function does not properly validate the length of input data before copying it into a fixed-size buffer, resulting in a classic buffer overflow condition. This improper bounds checking allows attackers to write beyond the allocated memory region.

Attack Vector

The attack is executed remotely over the network by sending a malicious HTTP request to the /goform/PowerSaveSet endpoint on the vulnerable Tenda AC23 router. The attacker crafts a request with an oversized Time parameter value that exceeds the expected buffer size. When processed by the sscanf function, the oversized input overflows the destination buffer, potentially overwriting adjacent memory regions including return addresses or function pointers.

The vulnerability requires low-privilege authentication but does not require any user interaction. Technical details and proof-of-concept code are available in the GitHub PoC Repository.

Detection Methods for CVE-2026-0640

Indicators of Compromise

• Unusual HTTP POST requests to /goform/PowerSaveSet with abnormally long Time parameter values
• Router crashes, unexpected reboots, or unresponsive web management interfaces
• Anomalous network traffic patterns originating from or directed at the router's management interface
• Unexpected changes to router configuration or firmware

Detection Strategies

• Implement network intrusion detection rules to monitor for HTTP requests to /goform/PowerSaveSet containing oversized parameters
• Deploy web application firewall (WAF) rules to detect and block requests with excessively long input values targeting Tenda router endpoints
• Enable logging on network devices to capture and analyze traffic to router management interfaces
• Use endpoint detection solutions to identify abnormal router behavior indicative of exploitation attempts

Monitoring Recommendations

• Monitor router system logs for segmentation faults, crashes, or unexpected restarts that could indicate exploitation attempts
• Implement network traffic analysis to detect scanning activity targeting Tenda router management ports
• Set up alerts for multiple failed or malformed requests to the PowerSaveSet endpoint
• Regularly audit router configurations for unauthorized changes

How to Mitigate CVE-2026-0640

Immediate Actions Required

• Restrict access to the router's web management interface to trusted networks only using firewall rules
• Disable remote management functionality if not required for operations
• Implement network segmentation to isolate IoT devices from critical network assets
• Monitor for vendor firmware updates and apply them promptly when released

Patch Information

At the time of publication, no official patch has been released by Tenda for this vulnerability. Organizations should monitor the Tenda Official Website for security updates and firmware releases addressing CVE-2026-0640. Additional vulnerability details are tracked at VulDB #339683.

Workarounds

• Configure firewall rules to block external access to the router's management interface (typically port 80/443)
• Implement access control lists (ACLs) to restrict which IP addresses can reach the /goform/PowerSaveSet endpoint
• Consider replacing the affected device with a router from a vendor with a more responsive security update cycle if no patch is forthcoming
• Deploy an upstream firewall or IPS to filter malicious requests before they reach the vulnerable device

# Example: iptables rule to restrict management interface access
# Block external access to router management port
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP