Security readout for executives and security teams
Plain-English summary
CVE-2026-1420 is a critical buffer overflow reported in Tenda AC23 firmware 16.03.07.52. A remote attacker with required access may be able to compromise the router through the WifiExtraSet endpoint. Public exploit material is referenced, but the supplied sources do not show confirmed active exploitation or a vendor fix.
Executive priority
Treat this as urgent for any deployed Tenda AC23 on the affected firmware, particularly internet-exposed or business-critical locations. Prioritize inventory, exposure reduction, and vendor update checks. Do not assume exploitation is active based on the supplied evidence, but public PoC availability increases operational risk.
Technical view
The issue affects an unknown function in /goform/WifiExtraSet. Manipulating the wpapsk_crypto argument can trigger a buffer overflow. The CVSS 2.0 vector is 9.0 with network access, low complexity, and single authentication. CWE-119 and CWE-120 are assigned. VulDB states remote exploitation is possible and exploit code has been published.
Likely exposure
Exposure is limited to Tenda AC23 devices running firmware 16.03.07.52, especially where router management or the affected endpoint is reachable from untrusted networks. The CVSS vector indicates authentication is required. The provided sources do not identify other affected Tenda models or firmware versions.
Exploitation context
The source bundle references a public PoC and says the exploit has been published and may be used. There is no KEV listing and no cited source confirming active in-the-wild exploitation. Because routers are perimeter-adjacent devices, compromise could affect traffic, credentials, and internal network access.
Researcher notes
Evidence is primarily from CVE/VulDB records and a referenced GitHub PoC. The affected function is not named beyond /goform/WifiExtraSet, and no vendor advisory or remediation details are included. Avoid expanding scope beyond AC23 firmware 16.03.07.52 without additional confirmation.
Mitigation direction
- Identify all Tenda AC23 devices and record firmware versions.
- Check Tenda’s official site for firmware updates or advisories for 16.03.07.52.
- Disable WAN-side administration if enabled.
- Restrict management access to trusted internal networks only.
- Change default or shared router administrator credentials.
- Consider replacement if no vendor-supported fix is available.
Validation and detection
- Inventory AC23 routers and confirm firmware version 16.03.07.52.
- Review whether management interfaces are reachable from the internet.
- Check logs for unusual administrative access or configuration changes.
- Monitor vendor and CVE sources for patch or advisory updates.
- Confirm any applied update changes the vulnerable firmware version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1420 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR810Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
9CriticalVector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
Source materials
- CVE List V5 sourceCVE List V5
- VDB-342836 | Tenda AC23 WifiExtraSet buffer overflowCVE reference · vdb-entry, technical-description
- VDB-342836 | CTI Indicators (IOB, IOC, IOA)CVE reference · signature, permissions-required
- Submit #736559 | Tenda AC23 V16.03.07.52 Buffer OverflowCVE reference · third-party-advisory
- https://github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow_WifiExtraSet/Tenda%20AC23_Buffer_Overflow_WifiExtraSet.mdCVE reference · broken-link, exploit
- https://www.tenda.com.cn/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.