A buffer overflow occurs in the return‑address handling of the sscanf function within the /goform/PowerSaveSet handler on Tenda AC23 firmware 16.03.07.52. By sending a specially crafted "Time" parameter that exceeds the expected length, an attacker can corrupt stack memory and redirect execution flow, leading to arbitrary code execution on the router. The vulnerability is a classic untrusted input flaw (CWE‑119, CWE‑120).

All Tenda AC23 routers that run firmware version 16.03.07.52 are affected. These devices expose the vulnerable endpoint through their web‑based management interface and are commonly accessed locally or remotely if the web interface is exposed to the Internet.

The CVSS score of 8.7 indicates a high severity, while the EPSS score of less than 1% suggests a low to moderate likelihood that exploitation occurs in the wild at present. The flaw is not catalogued in the CISA KEV database. Existence of public exploits illustrates that an attacker capable of reaching the router’s management interface—either locally or over the network—can trigger the overflow from afar, potentially taking full control of the device.