CVE-2025-12596 is a High severity (CVSS 8.8) buffer overflow in the Tenda AC23 router, firmware 16.03.07.52. The function saveParentControlInfo handles the Time argument unsafely. No fixed firmware is confirmed, so restrict access to the web interface and check Tenda for updates.
What's affected
The record names Tenda AC23 firmware 16.03.07.52. The affected code is the function saveParentControlInfo in /goform/saveParentControlInfo, which deals with parental control settings. The record says the attack can be started remotely and that the exploit has been made public.
Weakness classes: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-120 (Classic Buffer Overflow).
The vector says the attacker needs a low-privilege account. No fixed version is named in the record or its references, so do not assume one exists. Check the vendor's download and support pages for newer AC23 firmware.
How to check if you're exposed
- Find AC23 routers in your inventory. Home office and small branch sites are the usual places.
- Open the router's admin page and read the firmware version. The record covers 16.03.07.52.
- Check whether remote administration is turned on, and whether the admin page can be reached from the wide area network.
- Review who on the local network can reach the admin interface, such as guests or untrusted devices.
What to do now
- Turn off remote administration and make sure the admin page is only reachable from a trusted wired segment.
- Set a strong, unique administrator password.
- Check Tenda's support pages for firmware newer than 16.03.07.52 and install it once confirmed.
- Keep guests on a separate network from the one that can reach the admin page.
- If the model is not updated by the vendor, plan to replace it.
Why it matters
A buffer overflow happens when a program copies input into a fixed-size space without checking its length. The extra data overwrites neighbouring memory and can crash the device or, in worse cases, change what it runs. Router firmware is often written in C with little memory protection, so these bugs are common and tend to appear in several handlers at once.
Home and small office routers rarely update automatically, so a flaw can stay for years. Two of these reports were published together for the same firmware, which suggests more handlers share the pattern. The record does not report exploitation in the wild and the CVE is not in the CISA KEV catalog.
Quick check
Can I fix this without new firmware?
Not fully. You can reduce risk by turning off remote administration and limiting who can reach the admin page, but only a firmware fix removes the bug.
Sources
- Safeguard Gold entry for CVE-2025-12596
- NVD record for CVE-2025-12596 (published 2 November 2025), the basis for the scores, weakness classes and affected product data above
References listed in the NVD record (third-party reports and the vendor home page; no vendor advisory with a fixed version was confirmed):
- https://github.com/LX-LX88/cve/issues/9
- https://vuldb.com/?ctiid.330891
- https://vuldb.com/?id.330891
- https://vuldb.com/?submit.677585
- https://www.tenda.com.cn/
Last reviewed: 19 October 2026.
