CVE-2023-51972 is a critical command injection in the fromAdvSetLanIp function of Tenda AX1803 firmware 1.0.0.1, scored 9.8 by NVD. A remote attacker can run commands on the router. No fixed firmware is confirmed, so check Tenda's support site and keep the admin interface off the internet.
What's affected
CVE-2023-51972 affects Tenda AX1803 firmware version 1.0.0.1. NVD published it on 2024-01-10 with a score of 9.8 (critical) and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The record says the fromAdvSetLanIp function contains a command injection. It does not name a parameter. I found no vendor advisory or fixed version, and the reporter's page did not return readable content when I fetched it, so check Tenda's support site.
Unlike the other CVEs the same reporter filed against this router that month, which are stack overflows in the IPTV handlers, this is a different class: input reaches a system command instead of a memory buffer.
Weakness class: CWE-77.
How to check if you're exposed
Find your Tenda AX1803 units and read the firmware version in the router's admin interface, or on the product label for the hardware revision. Menu names vary by firmware. The record names version 1.0.0.1, so a unit reporting that version is in scope.
Then check how the admin interface is reachable. If remote management is enabled on the WAN side, or the router sits in a DMZ, the web service answers to the internet. From a machine outside your network, test whether the router's web port responds. If your ISP supplied the device, ask the ISP who manages its firmware.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages you ship. It does not inspect appliance firmware or a vendor's closed product, so for this CVE the useful work is asset inventory and vendor follow-up.
What to do now
- Inventory every Tenda AX1803 and note the firmware version. Pay attention to routers at remote sites and homes of staff who work remotely.
- Check Tenda's support site for firmware newer than 1.0.0.1 and read its release notes. I could not confirm a fixed version from the sources available, so verify it yourself before you rely on an update.
- Turn off remote web management and make sure the admin interface listens only on the LAN side.
- Use a strong, unique administrator password, and keep untrusted devices off the network segment that can reach the router's admin page.
- If no fixed firmware exists and the device protects something important, plan to replace it with a model that receives security updates.
Why it matters
The weakness is CWE-77, command injection. Router firmware often builds shell commands from settings, such as the LAN address, and passes the result to the system. If the value comes from a web request and is not checked, extra text in it can become part of the command. A LAN address setting is a natural place for this because the firmware expects a short, simple value and often trusts it.
Command execution is usually worse than a crash. On a router it can mean control over traffic, DNS settings and everything behind it. The record's KEV flag is false and I found no source reporting exploitation.
Quick check
Is a stack overflow different from command injection?
Yes. An overflow corrupts memory and needs careful crafting. Command injection abuses a string that the firmware passes to the system. Both give an attacker control, but the fixes differ.
What is the safest short term step?
Turn off remote management, keep the admin page on the LAN only, and check for newer firmware. Replace the device if none arrives.
Sources
Reporter write-up on Notion (listed in the record; the page did not return readable content when I fetched it)
NVD record for CVE-2023-51972 (the record this guide is built from)
Last reviewed: 19 October 2026.
