Security readout for executives and security teams
Plain-English summary
CVE-2026-0640 is a critical buffer overflow in Tenda AC23 firmware 16.03.07.52. A remote attacker with required access could abuse the PowerSaveSet function’s Time parameter to compromise the router. Public exploit information is reported, but the provided sources do not show confirmed active exploitation or a vendor patch.
Executive priority
Treat this as urgent for environments using Tenda AC23 routers. The combination of critical impact, remote reachability, and reported public exploit information makes exposed management interfaces a high business risk. Prioritize inventory, access restriction, and vendor guidance checks.
Technical view
The issue affects /goform/PowerSaveSet in Tenda AC23 16.03.07.52. Improper handling of the Time argument in an sscanf operation can cause a buffer overflow, mapped to CWE-119 and CWE-120. CVSS v2 is 9.0 with network access, low complexity, single authentication, and complete confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to Tenda AC23 devices running firmware 16.03.07.52, especially if the management interface is reachable by untrusted users. The CVSS vector indicates authentication is required, but remote exploitation is possible once that access condition is met.
Exploitation context
VulDB states an exploit has been made public and could be used for attacks. The provided bundle does not include evidence of CISA KEV listing or confirmed in-the-wild exploitation. GitHub exploit references are marked as broken links in the bundle, so exploit availability should be treated as reported but not fully validated here.
Researcher notes
Evidence is primarily from CVE and VulDB records. The CVSS v2 vector includes Au:S, so unauthenticated exploitation is not supported by the provided data. No official Tenda remediation is named in the sources. Avoid assuming broader Tenda models or firmware versions are affected.
Mitigation direction
- Identify Tenda AC23 devices and record firmware versions.
- Restrict router management access to trusted administrative networks only.
- Disable remote administration if not explicitly required.
- Check Tenda advisories and firmware downloads for official fixes.
- Replace or isolate affected devices if no vendor fix is available.
Validation and detection
- Confirm whether any AC23 device runs firmware 16.03.07.52.
- Review exposure of the web management interface.
- Verify administrative access is limited and logged.
- Check vendor site for newer firmware or advisories.
- Monitor logs for unexpected PowerSaveSet management activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-0640 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR810Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
9CriticalVector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
Source materials
- CVE List V5 sourceCVE List V5
- VDB-339683 | Tenda AC23 PowerSaveSet sscanf buffer overflowCVE reference · vdb-entry, technical-description
- VDB-339683 | CTI Indicators (IOB, IOC, IOA)CVE reference · signature, permissions-required
- Submit #731772 | Tenda AC23 V16.03.07.52 Buffer OverflowCVE reference · third-party-advisory
- https://github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow/Tenda%20AC23_Buffer_Overflow.mdCVE reference · broken-link, exploit
- https://www.tenda.com.cn/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.