CVE-2023-38937 in AC5
Summary
by MITRE • 08/07/2023
Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, AC5 V1.0 V15.03.06.28, AC9 V3.0 V15.03.06.42_multi and AC10 v4.0 V16.03.10.13 were discovered to contain a stack overflow via the list parameter in the formSetVirtualSer function.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/21/2026
This vulnerability affects multiple Tenda wireless router models including AC10 V1.0, AC1206, AC8 v4, AC6 V2.0, AC7, AC5, AC9, and AC10 v4.0, all running specific firmware versions. The issue stems from a stack overflow condition in the formSetVirtualSer function where the list parameter is not properly validated or sanitized. This flaw represents a critical security weakness that can be exploited by remote attackers to execute arbitrary code on affected devices. The vulnerability is classified under CWE-121 as a stack-based buffer overflow, which occurs when data is written beyond the bounds of a fixed-length buffer allocated on the stack. Such vulnerabilities are particularly dangerous because they can lead to complete system compromise and allow attackers to gain unauthorized access to network devices.
The technical implementation of this vulnerability involves the improper handling of user-supplied input through the list parameter within the formSetVirtualSer function. When an attacker sends a specially crafted request containing excessive data in the list parameter, the system fails to validate the input length before copying it into a fixed-size stack buffer. This results in memory corruption that can overwrite adjacent stack variables, function return addresses, or other critical program data. The attack vector is remote and unauthenticated, meaning an attacker can exploit this vulnerability without requiring physical access or prior authentication to the device. This characteristic significantly increases the exploitability and potential impact of the vulnerability across networked environments.
The operational impact of this vulnerability extends beyond simple code execution to encompass complete device compromise and potential network infiltration. Successful exploitation can allow attackers to gain root access to affected routers, enabling them to modify network configurations, redirect traffic, install malicious firmware, or establish persistent backdoors. The affected devices serve as critical network infrastructure components, making their compromise particularly damaging as it can affect entire network segments. Network administrators face significant challenges in identifying and mitigating this vulnerability since it can be exploited remotely without detection, potentially allowing attackers to maintain long-term access to compromised networks. This vulnerability also impacts the integrity of network communications and can lead to data interception or modification.
Mitigation strategies for this vulnerability should include immediate firmware updates from Tenda to address the stack overflow issue in the affected models. Organizations should implement network monitoring to detect unusual traffic patterns that might indicate exploitation attempts. Network segmentation and access control measures can limit the potential damage from a compromised device. Additionally, implementing intrusion detection systems and regular security audits can help identify and respond to exploitation attempts. The vulnerability aligns with ATT&CK technique T1059.007 for command and script interpreter and T1068 for exploit for privilege escalation. Security teams should also consider disabling unnecessary services and implementing network access controls to reduce the attack surface of affected devices. Regular vulnerability assessments and patch management processes are essential to prevent similar issues in other network infrastructure components.