PT-2025-38723

CVE-2025-10803

Published

2025-09-22

Updated

2025-09-22

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC23 versions up to 16.03.07.52

Description A buffer overflow issue exists in the HTTP POST Request Handler component of Tenda AC23. The issue is due to the manipulation of the startIp argument within the sscanf function located in the /goform/SetPptpServerCfg file. This allows for remote exploitation. The exploit has been publicly disclosed.

Recommendations Update Tenda AC23 to a version later than 16.03.07.52.

Exploitability

Exploit

Fix

Impacts

Researchers

Qmssdxn

Vendors

Affected products

Weakness enumeration

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-120: Buffer Copy without Checking Size of Input (\'Classic Buffer Overflow\')