CVE-2025-10803

Tenda AC23 HTTP POST Request SetPptpServerCfg sscanf buffer overflow

State: Published
Severity: 8.7 High
Published: Sep 22, 2025
Updated: Sep 22, 2025
Reserved: Sep 21, 2025

Description

A vulnerability has been found in Tenda AC23 up to 16.03.07.52. Affected by this vulnerability is the function sscanf of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	VulDB
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
3.0	8.8 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
2.0	9.0 High	AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-120 Buffer Overflow
CWE-119 Memory Corruption

Affected Products

Product	Versions
AC23Tenda	16.03.07.0Affected 16.03.07.1Affected 16.03.07.2Affected 16.03.07.3Affected 16.03.07.4Affected 16.03.07.5Affected 16.03.07.6Affected 16.03.07.7Affected 16.03.07.8Affected 16.03.07.9Affected 16.03.07.10Affected 16.03.07.11Affected 16.03.07.12Affected 16.03.07.13Affected 16.03.07.14Affected 16.03.07.15Affected 16.03.07.16Affected 16.03.07.17Affected 16.03.07.18Affected 16.03.07.19Affected 16.03.07.20Affected 16.03.07.21Affected 16.03.07.22Affected 16.03.07.23Affected 16.03.07.24Affected and 28 more versions

Product

Versions

AC23Tenda

16.03.07.0Affected
16.03.07.1Affected
16.03.07.2Affected
16.03.07.3Affected
16.03.07.4Affected
16.03.07.5Affected
16.03.07.6Affected
16.03.07.7Affected
16.03.07.8Affected
16.03.07.9Affected
16.03.07.10Affected
16.03.07.11Affected
16.03.07.12Affected
16.03.07.13Affected
16.03.07.14Affected
16.03.07.15Affected
16.03.07.16Affected
16.03.07.17Affected
16.03.07.18Affected
16.03.07.19Affected
16.03.07.20Affected
16.03.07.21Affected
16.03.07.22Affected
16.03.07.23Affected
16.03.07.24Affected
and 28 more versions

References

VDB-325161 | Tenda AC23 HTTP POST Request SetPptpServerCfg sscanf buffer overflowvdb-entrytechnical-description
VDB-325161 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #654237 | Tenda AC23 <= V16.03.07.52 Buffer Overflowthird-party-advisory
https://github.com/lin-3-start/lin-cve/blob/main/Tenda%20AC23-3/Tenda%20AC23%20Buffer%20overflow.mdexploit
https://www.tenda.com.cn/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.