CVE-2025-10803

Tenda AC23 HTTP POST Request SetPptpServerCfg sscanf buffer overflow

View on CVE.org
Published Sep 22, 2025 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in Tenda AC23 up to 16.03.07.52. Affected by this vulnerability is the function sscanf of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-30760 A vulnerability has been found in Tenda AC23 up to 16.03.07.52. Affected by this vulnerability is the function sscanf of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
History
Type Values Removed Values Added
First Time appeared Tenda ac23 Firmware
CPEs cpe:2.3:h:tenda:ac23:1.0:*:*:*:*:*:*:*
cpe:2.3:o:tenda:ac23_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda ac23 Firmware
Type Values Removed Values Added
First Time appeared Tenda
Tenda ac23
Vendors & Products Tenda
Tenda ac23
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in Tenda AC23 up to 16.03.07.52. Affected by this vulnerability is the function sscanf of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Title Tenda AC23 HTTP POST Request SetPptpServerCfg sscanf buffer overflow
Weaknesses CWE-119
CWE-120
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 22, 2025, 5:18 PM
Reserved
Sep 21, 2025, 9:39 AM

View source JSON

Updated
Sep 22, 2025, 5:17 PM

JSON

Status
Analyzed
Published
Sep 22, 2025, 3:15 PM
Modified
Jun 17, 2026, 8:29 AM

View source JSON

No data.

Updated
Sep 23, 2025, 4:09 PM

JSON