CVE-2023-49427 is a high severity buffer overflow, scored 7.5, in Tenda AX12 firmware V22.03.01.46. A remote attacker can crash the router through the list parameter of the SetNetControlList function. The record names no fixed version, so check Tenda for newer firmware and disable remote management.
What's affected
The record says a buffer overflow in Tenda AX12 V22.03.01.46 lets remote attackers cause a denial of service through the list parameter in the SetNetControlList function. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so the impact is on availability only, and no privileges are needed.
The single reference is a researcher write up on GitHub, which I did not retrieve. The record has no fixed version, so I will not suggest one.
How to check if you're exposed
Open the router's administration page and read the firmware version under the system status or upgrade section. The record names V22.03.01.46. A match means your unit is in the affected set.
Also confirm whether the management page is reachable from the internet side of the router, because that determines who can send the request.
What to do now
- Read the firmware version on each Tenda AX12.
- Look at Tenda's download page for a newer AX12 firmware and read its notes. The record does not state a fix.
- Disable remote management so only the local network can reach the router's configuration.
- If the router is critical to a site, have a spare or a documented recovery plan, since the impact is a crash.
- Reboot behaviour after a crash varies by device, so test how your unit recovers.
- Keep the advisory in your tracker and check Tenda's download page again after each firmware release.
Why it matters
The weakness is an out-of-bounds write, CWE-787. Input in the list parameter is copied into a buffer that is too small. The record frames the result as a crash rather than code execution.
Denial of service on a home or branch router is an annoyance for one office and a serious problem for a remote site. The practical defense is to keep the management service off the internet. KEV status is false for this CVE.
For a defender with a fleet of consumer grade routers, the practical question is lifecycle. Ask whether the vendor still ships firmware for this model, and keep a spare configuration backup so a crashed or replaced unit can be restored quickly. Segment management traffic and log administrative access where the device allows it.
Quick check
Does this allow code execution?
The record only describes a denial of service. Memory corruption bugs can sometimes go further, but this post does not claim that.
Sources
Researcher write up referenced by NVD (not fetched)
Last reviewed: 19 October 2026.
