CVE-2026-0640 is a buffer overflow in the Tenda AC23 router, firmware 16.03.07.52, in the /goform/PowerSaveSet handler. NVD scores it 8.8, high severity, and says an exploit is public. No fixed firmware is named, so close remote admin and look for an update from Tenda.
What's affected
- Product: Tenda AC23 and its firmware, version 16.03.07.52.
- Component: the sscanf call in /goform/PowerSaveSet, argument Time.
- Fixed version: none listed. Check the vendor site for your model.
- Severity: CVSS 8.8, vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Low privileges are required. - Exploitation: the record says an exploit is public. It is not on the CISA KEV list.
How to check if you're exposed
Router and firewall firmware is not scanned by a package manager, so the check is manual.
- Log in to the device admin page and read the firmware version on the status or system page.
- Compare it with the version named in this post.
- Test from outside your network that the management interface does not answer. From a host you own on another network:
nmap -Pn -p 80,443,8080 YOUR_PUBLIC_IP
The record names firmware 16.03.07.52 only. Other builds may or may not be affected, so ask Tenda if you run a different one.
What to do now
- Open the Tenda support site (https://www.tenda.com.cn/) and look for a newer firmware for your exact model. The CVE record does not name a fixed version.
- If a newer firmware exists, read its release notes, back up the device configuration, and install it during a quiet window.
- Turn off remote administration from the internet. Management should be reachable only from a trusted LAN or VPN.
- Change the admin password if it is shared or old, and remove any accounts you do not use.
- If no update exists and the device sits at the edge of a network that matters, plan its replacement. Record the CVE in your asset register until then.
Why it matters
The weakness is CWE-119 (improper restriction of operations within the bounds of a memory buffer) and its more specific child CWE-120 (classic buffer copy without checking the size of the input). The record says the Time argument is parsed with sscanf, a C function that writes into a buffer of fixed size, and that overlong input can overflow it.
Memory flaws in router firmware matter because the web server often runs with full privileges and there is no sandbox around it. The public report page linked from the record returned not found when I tried it, so this post relies on the CVE record alone.
Quick check
Why does the record score this 8.8 when it needs a login?
The impact ratings are high for confidentiality, integrity and availability, and the attack is rated low complexity. The login requirement only lowers the score a little.
Does the record name a patched firmware?
No. Check the Tenda support page for your model and treat the router as exposed until you have installed an update or replaced it.
Sources
Last reviewed: 19 October 2026.
