CVE-2023-26976
Published: 04 April 2023
Summary
CVE-2023-26976 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac6 Firmware. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 4.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda AC6 firmware version 15.03.05.09_multi contains a stack-based buffer overflow in the form_fast_setting_wifi_set function triggered by the ssid parameter. The flaw is tracked as CVE-2023-26976 and carries a CVSS 3.1 score of 7.5, reflecting network-reachable unauthenticated input that results in an out-of-bounds write (CWE-787) and high availability impact.
An unauthenticated attacker can supply an oversized or malformed ssid value in a single HTTP request to the affected endpoint, causing the device to crash or become unresponsive. Because the call requires no credentials and can be issued remotely, the vulnerability allows denial-of-service against any exposed administrative interface.
Public references consist of GitHub repositories documenting the issue but contain no vendor advisory, firmware update, or mitigation guidance. The associated EPSS score rose from a low baseline to a peak of 0.5558 before receding to its current value of 0.1862, indicating a period of elevated exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-30766
Vulnerability details
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.