Details of VAR-202305-2373

ID

VAR-202305-2373

CVE

CVE-2023-2923

TITLE

Shenzhen Tenda Technology Co.,Ltd. of AC6 Out-of-bounds write vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2023-007369

DESCRIPTION

A vulnerability classified as critical was found in Tenda AC6 US_AC6V1.0BR_V15.03.05.19. Affected by this vulnerability is the function fromDhcpListClient. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230077 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Shenzhen Tenda Technology Co.,Ltd. of AC6 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The Tenda AC6 is a dual-band wireless router from Tenda that supports both 2.4GHz and 5GHz bands, with a maximum transmission rate of 1167Mbps. An attacker could exploit this vulnerability to cause a denial of service

Trust: 2.16

sources: NVD: CVE-2023-2923 // JVNDB: JVNDB-2023-007369 // CNVD: CNVD-2025-24491

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-24491

AFFECTED PRODUCTS

vendor:	tenda	model:	ac6	scope:	eq	version:	us_ac6v1.0br_v15.03.05.19	Trust: 1.0
vendor:	tenda	model:	ac6	scope:	eq	version:	ac6 firmware us ac6v1.0br v15.03.05.19	Trust: 0.8
vendor:	tenda	model:	ac6	scope:	-	version:	-	Trust: 0.8
vendor:	tenda	model:	ac6	scope:	eq	version:	-	Trust: 0.8
vendor:	tenda	model:	ac6 us ac6v1.0br v15.03.05.19	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-24491 // JVNDB: JVNDB-2023-007369 // NVD: CVE-2023-2923

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2023-2923
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2023-2923
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2023-2923
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2025-24491
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202305-2328
value:	CRITICAL
Trust: 0.6

cna@vuldb.com:	CVE-2023-2923
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
CNVD:	CNVD-2025-24491
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cna@vuldb.com:	CVE-2023-2923
baseSeverity:	MEDIUM
baseScore:	6.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	3.4
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2023-2923
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2023-2923
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-24491 // CNNVD: CNNVD-202305-2328 // JVNDB: JVNDB-2023-007369 // NVD: CVE-2023-2923 // NVD: CVE-2023-2923

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.0
problemtype:	CWE-121	Trust: 1.0
problemtype:	Out-of-bounds writing (CWE-787) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2023-007369 // NVD: CVE-2023-2923

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202305-2328

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202305-2328

EXTERNAL IDS

db:	NVD	id:	CVE-2023-2923	Trust: 3.8
db:	VULDB	id:	230077	Trust: 3.0
db:	JVNDB	id:	JVNDB-2023-007369	Trust: 0.8
db:	CNVD	id:	CNVD-2025-24491	Trust: 0.6
db:	CNNVD	id:	CNNVD-202305-2328	Trust: 0.6

sources: CNVD: CNVD-2025-24491 // CNNVD: CNNVD-202305-2328 // JVNDB: JVNDB-2023-007369 // NVD: CVE-2023-2923

REFERENCES

url:	https://github.com/gleamingeyes/vul/blob/main/1.md	Trust: 3.0
url:	https://vuldb.com/?id.230077	Trust: 3.0
url:	https://vuldb.com/?ctiid.230077	Trust: 2.2
url:	https://nvd.nist.gov/vuln/detail/cve-2023-2923	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2023-2923/	Trust: 0.6

sources: CNVD: CNVD-2025-24491 // CNNVD: CNNVD-202305-2328 // JVNDB: JVNDB-2023-007369 // NVD: CVE-2023-2923

SOURCES

db:	CNVD	id:	CNVD-2025-24491
db:	CNNVD	id:	CNNVD-202305-2328
db:	JVNDB	id:	JVNDB-2023-007369
db:	NVD	id:	CVE-2023-2923

LAST UPDATE DATE

2025-11-19T23:30:59.977000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-24491	date:	2025-10-22T00:00:00
db:	CNNVD	id:	CNNVD-202305-2328	date:	2023-06-05T00:00:00
db:	JVNDB	id:	JVNDB-2023-007369	date:	2023-11-21T08:08:00
db:	NVD	id:	CVE-2023-2923	date:	2024-05-17T02:23:22.090

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-24491	date:	2025-10-22T00:00:00
db:	CNNVD	id:	CNNVD-202305-2328	date:	2023-05-27T00:00:00
db:	JVNDB	id:	JVNDB-2023-007369	date:	2023-11-21T00:00:00
db:	NVD	id:	CVE-2023-2923	date:	2023-05-27T08:15:10.297