A critical buffer overflow vulnerability in Tenda AC23 routers, specifically in the PowerSaveSet function, poses a significant risk of remote code execution.

This vulnerability is a buffer overflow (CWE-120) occurring within the sscanf function of the /goform/PowerSaveSet file. The flaw can be triggered remotely by sending a manipulated Time argument, allowing an authenticated user to cause memory corruption.

The exploitation of this vulnerability can lead to a total loss of system integrity and availability, potentially allowing an attacker to gain control over network traffic or disrupt critical business communication. With a CVSS score of 8.8, this flaw represents a high-severity risk that could facilitate unauthorized access to sensitive internal network segments.

Immediate Action: Since a specific patch version is not currently identified, users should restrict access to the web management interface of the Tenda AC23 to trusted internal IP addresses only.

Proactive Monitoring: Security teams should monitor network logs for unusual traffic patterns directed at the /goform/PowerSaveSet endpoint and investigate any unexpected device reboots.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with rules configured to inspect and block malicious payloads targeting the PowerSaveSet function.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up provided via the referenced GitHub repository.

Given the confirmed existence of a public proof-of-concept and the potential for remote code execution, this vulnerability demands immediate attention. Administrators must prioritize isolating the affected hardware from the public internet and monitoring for signs of unauthorized manipulation until a vendor-supplied firmware update is verified and applied.