ID
VAR-202510-0111
CVE
CVE-2025-11356
TITLE
Shenzhen Tenda Technology Co.,Ltd. of ac23 Buffer error vulnerability in firmware
Trust: 0.8
DESCRIPTION
A vulnerability was found in Tenda AC23 up to 16.03.07.52. Affected by this issue is the function sscanf of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. of ac23 The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. It offers dual-band concurrent transmission rates up to 2033 Mbps, with the 5 GHz band reaching up to 1733 Mbps. It is suitable for high-bandwidth applications such as 4K video and online live streaming. This vulnerability stems from the failure of the sscanf function in the file /goform/SetStaticRouteCfg to properly validate the length of the input data in the parameter list. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | tenda | model: | ac23 | scope: | eq | version: | 16.03.07.52 | Trust: 1.0 |
| vendor: | tenda | model: | ac23 | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | ac23 | scope: | eq | version: | ac23 firmware 16.03.07.52 | Trust: 0.8 |
| vendor: | tenda | model: | ac23 | scope: | - | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | ac23 | scope: | lte | version: | <=16.03.07.52 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-120 | Trust: 1.0 |
| problemtype: | CWE-119 | Trust: 1.0 |
| problemtype: | Buffer error (CWE-119) [ others ] | Trust: 0.8 |
| problemtype: | Classic buffer overflow (CWE-120) [ others ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2025-11356 | Trust: 3.2 |
| db: | VULDB | id: | 327241 | Trust: 1.8 |
| db: | JVNDB | id: | JVNDB-2025-015865 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-24475 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/cymiao1978/cve/blob/main/12.md | Trust: 2.4 |
| url: | https://vuldb.com/?id.327241 | Trust: 1.8 |
| url: | https://vuldb.com/?submit.664923 | Trust: 1.8 |
| url: | https://www.tenda.com.cn/ | Trust: 1.8 |
| url: | https://vuldb.com/?ctiid.327241 | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2025-11356 | Trust: 0.8 |
SOURCES
| db: | CNVD | id: | CNVD-2025-24475 |
| db: | JVNDB | id: | JVNDB-2025-015865 |
| db: | NVD | id: | CVE-2025-11356 |
LAST UPDATE DATE
2025-11-19T23:27:11.671000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-24475 | date: | 2025-10-22T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-015865 | date: | 2025-10-14T06:52:00 |
| db: | NVD | id: | CVE-2025-11356 | date: | 2025-10-09T16:46:52.087 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-24475 | date: | 2025-10-21T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-015865 | date: | 2025-10-14T00:00:00 |
| db: | NVD | id: | CVE-2025-11356 | date: | 2025-10-07T07:15:44.933 |