CVE-2026-1420
Published: 26 January 2026
Summary
CVE-2026-1420 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac23 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-1420 by requiring timely identification, reporting, and patching of the buffer overflow flaw in Tenda AC23 firmware.
Requires validation of the wpapsk_crypto argument in the /goform/WifiExtraSet endpoint to prevent buffer overflow exploitation.
Implements memory protections such as stack guards and address space randomization to thwart arbitrary code execution from the buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web endpoint (/goform/WifiExtraSet) directly enables remote exploitation of a public-facing application for code execution and device compromise.
NVD Description
A flaw has been found in Tenda AC23 16.03.07.52. This impacts an unknown function of the file /goform/WifiExtraSet. This manipulation of the argument wpapsk_crypto causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and…
more
may be used.
Deeper analysisAI
CVE-2026-1420 is a buffer overflow vulnerability (CWE-119, CWE-120) in Tenda AC23 router firmware version 16.03.07.52. The issue affects an unknown function in the /goform/WifiExtraSet file, where manipulation of the wpapsk_crypto argument triggers the overflow. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation by attackers with low privileges, requiring network access, low complexity, and no user interaction. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or full device compromise.
References include GitHub proof-of-concept exploits detailing the buffer overflow in Tenda AC23's WifiExtraSet endpoint. VulDB advisories (CTI ID 342836, ID 342836; submission 736559) document the flaw, noting that the published exploit may be used in attacks.
The exploit has been publicly released, raising concerns for real-world exploitation against unpatched Tenda AC23 devices.
Details
- CWE(s)