A critical buffer overflow vulnerability in Tenda AC23 routers allows remote attackers to compromise device stability or execute arbitrary code via the PPTP server configuration interface.

This vulnerability involves a stack-based buffer overflow in the sscanf function within the /goform/SetPptpServerCfg component. The flaw is triggered when an attacker sends a malicious HTTP POST request with an oversized startIp parameter, which lacks proper bounds checking.

Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution on the affected router, potentially leading to a complete compromise of the network gateway. Given the CVSS score of 8.8, this represents a high-severity risk that could facilitate unauthorized network access, data interception, or the deployment of persistent threats within the internal environment.

Immediate Action: Contact the vendor or check the official Tenda support website for firmware updates addressing this vulnerability. If no patch is available for your specific build, restrict access to the web management interface to trusted administrative IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual HTTP POST requests directed at the /goform/SetPptpServerCfg endpoint. Review router logs for unexpected service restarts or anomalous error messages that may indicate failed exploitation attempts.

Compensating Controls: Implement a Web Application Firewall or network-level access control list to block unauthorized access to the router management interface. Ensure that PPTP services are disabled if not strictly required for business operations.

Public Exploit Available: Yes, a functional proof-of-concept has been published in the researcher's technical write-up on GitHub.

This vulnerability poses a significant risk to network integrity due to the availability of proof-of-concept exploit code. Administrators must prioritize the identification of affected Tenda AC23 units and apply vendor-provided firmware updates as soon as they become available. Until a patch is deployed, strictly isolate the device management interface from untrusted networks to prevent remote exploitation.