CVE-2026-1420 is a high severity buffer overflow (CVSS 8.8) in the Tenda AC23 router, firmware 16.03.07.52. The wpapsk_crypto argument of the /goform/WifiExtraSet handler overflows a buffer, and a login is needed. We could not confirm a fixed firmware, so limit access to the admin page.
What's affected
The record names Tenda AC23 firmware 16.03.07.52. The affected file is /goform/WifiExtraSet and the argument is wpapsk_crypto. The record does not say whether other firmware versions are affected, and it names no fixed version. The only vendor reference is the Tenda home page, which has no advisory, so check the Tenda support site for newer firmware for your model.
How to check if you're exposed
Log in to the router admin page and read the firmware version on the system status page. If it shows 16.03.07.52, it is the version in the record.
Check whether the admin interface is reachable from the internet through remote management or port forwarding, and turn that off. The record says remote exploitation is possible and needs a low privilege login.
What to do now
- Read the firmware version on your Tenda AC23.
- Turn off remote management and any port forwarding to the admin page.
- Change the admin password to a long unique one and remove unknown accounts.
- Check the Tenda support site for newer firmware and apply it if one exists.
- If the router sits in a business setting and cannot be patched, plan a replacement.
Why it matters
A buffer overflow happens when input longer than the space set aside for it is copied without a length check. On a router that can corrupt memory and may allow code execution on the device, which sits at the edge of the whole network. The record lists CWE-119 and CWE-120, memory buffer errors and classic buffer overflow.
The record says the exploit has been published and may be used. That is a statement about availability of details, not about confirmed attacks, and the record does not flag the CVE as known exploited. The practical defense for home and small office routers is keeping the admin page off the internet.
The record lists these weakness classes: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-120 (Classic Buffer Overflow).
Quick check
Is there a firmware fix?
We could not confirm one. The record cites no vendor advisory, so check the Tenda support site for your model.
Sources
Last reviewed: 19 October 2026.
