A flaw in Tenda AC23 firmware 16.03.07.52 allows an attacker to trigger a buffer overflow by providing a specially crafted wpapsk_crypto argument to the /goform/WifiExtraSet endpoint. The overflow could corrupt execution control data on the router’s stack, potentially enabling arbitrary code execution or denial of service. Risks include unauthorized control of the wireless access point and exposure of connected network traffic.

The affected device is the Tenda AC23 Wi‑Fi router running firmware version 16.03.07.52. No other firmware releases are listed as vulnerable, and the flaw is reported to affect this specific build.

The CVSS score of 8.7 indicates high severity. EPSS is reported as less than 1%, signifying a low but non‑zero probability of exploitation in the wild; it is not currently listed in the CISA KEV catalog. The vulnerability is exploitable remotely without authentication, as the relevant endpoint is reachable over the network. Attackers could craft a request to trigger the overflow and execute arbitrary code on the router. Given the existence of published exploits, the risk to exposed devices is substantial.