Tenda CH22
CVE-2025-11418
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP management interface
-
DeliverySend crafted /goform/AdvSetWrlsafeset request
-
ExploitOverflow stack buffer via mit_ssid_index
-
ExecutionHijack control flow on device
-
ImpactExecute code or crash router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Tenda CH22 router's HTTP management interface (the HTTP Request Handler component) and the ability to send a request to the /goform/AdvSetWrlsafeset endpoint invoking formWrlsafeset with a crafted mit_ssid_index value. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special configuration are required against affected firmware (up to 1.0.0.1) in default state. The primary limiting factor is exposure of the management interface: on typical deployments this is LAN-facing, so remote Internet exploitation depends on the admin interface being reachable (e.g., WAN-side remote management enabled or an attacker already on the local network). |
| Impact | Signals are largely consistent and point to a genuine, elevated concern for exposed devices. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), scoring 8.9. This aligns with a publicly available POC and an EPSS of 6.71% at the 94th percentile - high relative to the overall CVE population, indicating elevated exploitation interest, though still well under a coin-flip in absolute terms. The CVSS 4.0 vector carries E:P (Proof-of-Concept), which is corroborated by the referenced GitHub exploit. The vulnerability is NOT in CISA KEV, so there is no confirmation of active in-the-wild exploitation; the EPSS/KEV picture suggests opportunistic potential rather than verified mass exploitation. One caveat: the only source is VulDB/the reporter (cna@vuldb.com) with no independent vendor advisory, and the stated impact (VC:H/VI:H/VA:H) is the reporter's assessment of a stack-based overflow whose real-world outcome on this embedded target may range from reliable remote code execution to device crash/DoS - the achievability of full code execution is not independently verified. |
| Exploit ScenarioDerived | An attacker with network reachability to a Tenda CH22 router's web management interface sends a crafted HTTP request to /goform/AdvSetWrlsafeset with an oversized or malformed mit_ssid_index argument, overflowing a stack buffer in the formWrlsafeset handler. Because the vector is unauthenticated and low-complexity, this can be triggered directly against the HTTP service, and a public POC exists (referenced GitHub issue), potentially corrupting control flow to crash the device or execute attacker-controlled code with the web server's privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Stack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to potentially execute arbitrary code by sending a crafted HTTP request to the /goform/AdvSetWrlsafeset endpoint with a malicious mit_ssid_index parameter. Publicly available exploit code exists, and the EPSS score is 6.71% (94th percentile), indicating elevated risk for exposed devices. Exploitation requires network access to the router's management interface, which is typically LAN-facing; Internet-based attacks depend on remote management being enabled or an attacker already on the local network.
RemediationAI
No vendor-released patch has been identified at the time of analysis. Until a fix is available, immediately mitigate exposure by disabling remote management on the WAN interface if it is not required; this prevents Internet-based exploitation but may impact legitimate remote administration. Restrict access to the router's HTTP management interface to trusted internal networks only via firewall rules or VLAN segmentation. Because publicly available exploit code exists and the vulnerability is unauthenticated, consider replacing the device or isolating it on a separate network segment if remote management cannot be disabled. Monitor the vendor's website (https://www.tenda.com.cn/) and the referenced VulDB entries for patch announcements. Additionally, monitor network traffic for anomalous requests to /goform/AdvSetWrlsafeset.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the HTTP Request Handler component of Tenda CH22 firmware, specifically within the formWrlsafeset function invoked via the /goform/AdvSetWrlsafeset endpoint. Improper bounds checking on the mit_ssid_index argument leads to a stack-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). This memory corruption can overwrite control data on the stack, potentially enabling arbitrary code execution with the privileges of the HTTP service. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the attack is remotely exploitable without authentication, user interaction, or special configuration. The affected CPE, cpe:2.3:o:tenda:ch22_firmware:*:*:*:*:*:*:*:*, indicates that all firmware versions of the CH22 model up to 1.0.0.1 are vulnerable.
Know when Ch22 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Unauthenticated network request to the web handler (AV:N/AC:L/PR:N/UI:N); stack overflow in device firmware can yield code execution affecting confidentiality, integrity, and availability, so C/I/A:H.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in Tenda CH22 up to 1.0.0.1. This issue affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of the component HTTP Request Handler. The manipulation of the argument mit_ssid_index leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
Tenda CH22 routers running firmware up to and including version 1.0.0.1 contain a memory-corruption flaw that can allow an attacker to run arbitrary code on the device, and no vendor-released patch is currently identified. Because these routers typically sit at branch or edge locations and expose a management interface, a compromise could hand an attacker a persistent foothold for traffic interception or lateral movement into the wider network. Leadership should care because the only effective mitigation available today is network-level containment, which requires coordinated action across network and IT operations teams rather than a simple software update.
No vendor-released patch identified at time of analysis. Interim mitigations: disable remote/WAN management and Internet exposure of the management interface; restrict management access to trusted VLANs or jump hosts; block or alert on requests to /goform/AdvSetWrlsafeset; deploy IPS/IDS signatures for the parameter abuse; segment affected routers away from production networks; and replace end-of-support units.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Ch22 Firmware
View allTenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. Rated critical severi
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. Rated critical severity (C
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a
Critical stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1 affecting the /goform/addUserName endpo
Critical stack-based buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1, affecting the formNatl
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exp
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code o
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interf
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interfa
Buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) allows an attacker with a low-privilege authenticate
Exploit-DB