CVE-2025-10803 | Tenda AC23 up to 16.03.07.52 HTTP POST Request /goform/SetPptpServerCfg sscanf startIp buffer overflow

A vulnerability labeled as critical has been found in Tenda AC23 up to 16.03.07.52. Affected by this vulnerability is the function sscanf of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp leads to buffer overflow.

This vulnerability is referenced as CVE-2025-10803. It is possible to launch the attack remotely. Furthermore, an exploit is available.