Critical severity · published Aug 7, 2023
CVE-2023-38931
Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, AC10 v4.0 V16.03.10.13…
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, AC10 v4.0 V16.03.10.13 and FH1203 V2.0.1.6 were discovered to contain a stack overflow via the list parameter in the setaccount function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Ac10 Firmware · Tenda
15.03.06.23; 16.03.10.13 · source: NVD
AF
Ac1206 Firmware · Tenda
15.03.06.23 · source: NVD
AF
Ac5 Firmware · Tenda
15.03.06.28 · source: NVD
AF
Ac6 Firmware · Tenda
15.03.06.23 · source: NVD
AF
Ac7 Firmware · Tenda
15.03.06.44 · source: NVD
AF
Ac8 Firmware · Tenda
16.03.34.06 · source: NVD
FF
F1203 Firmware · Tenda
2.0.1.6 · source: NVD
FF
Fh1203 Firmware · Tenda
2.0.1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-38931
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-38931
Exploit
https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/cloudv2_setaccount/README.md
More from Ac10 Firmware
9.8
CVE-2018-14558
Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
9.8
CVE-2026-19924
Tenda AC10 httpd R7WebsSecurityHandler improper authentication
9.8
CVE-2025-67073
A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code…
9.8
CVE-2025-12622
A vulnerability was determined in Tenda AC10 16.03.10.13
9.8
CVE-2025-5629
A vulnerability, which was classified as critical, was found in Tenda AC10 up to 15.03.06.47