CVE-2023-40800

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The compare_parentcontrol_time function does not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-408018.8The sub_451784 function does not validate the parameters entered by the user, resulting in a stack overflow vulnerability in Tenda AC23 v16.CVE-2023-408026.5The get_parentControl_list_Info function does not verify the parameters entered by the user, causing a post-authentication heap overflow vul CVE-2023-408096.1OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.CVE-2023-408106.1OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.CVE-2023-408126.1OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.CVE-2023-408136.1OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.CVE-2023-408146.1OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.CVE-2023-408156.1OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.CVE-2023-408166.1OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.CVE-2023-408176.1OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field.CVE-2023-408196.1ID4Portais in version < V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Injection vulnerability.CVE-2023-408257.2An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/