Tenda CH22 CVE-2025-11423

Exploitation requires network reachability to the device's HTTP web-management service and the ability to send a request to the specific endpoint /goform/SafeEmailFilter (the SafeEmailFilter / email-filter feature of the CH22) with a manipulated 'page' parameter. The affected build is specifically Tenda CH22 firmware 1.0.0.1. Per the provided CVSS vector (PR:N, UI:N), no authentication or user interaction is indicated, so against a default configuration the primary limiting factor is exposure of the management interface: real-world reach is typically limited to the LAN unless WAN-side remote administration is enabled, which sharply reduces internet-wide exposure. Note the authentication claim rests solely on the CVSS PR:N value and is not independently confirmed by the description.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw with high impact to confidentiality, integrity, and availability, yielding a base score of 8.9. However, several signals temper this on real-world priority. The EPSS score is only 0.86% (57th percentile), which is modest and argues against mass, automated exploitation at present. The vulnerability is NOT in CISA KEV, so there is no evidence of confirmed active exploitation. Public exploit code exists (referenced GitHub issue) and the CVSS 4.0 exploit-maturity metric is E:P (Proof-of-Concept), consistent with 'publicly available exploit code exists' rather than weaponized in-the-wild use. Conflict to note: the input is reported by VulDB (cna@vuldb.com), a source that frequently auto-publishes lightly-verified SOHO-router 'memory corruption' reports; whether the described corruption yields reliable remote code execution (justifying VI:H/VC:H) versus merely a denial-of-service crash is not substantiated by the description - the H integrity/confidentiality impacts should be treated as INFERRED/aspirational, not confirmed. No SSVC decision record is provided in the input, so automatable/technical-impact cannot be stated from SSVC. Net: a genuinely remote, pre-auth bug in an exposed device is serious if the web interface is internet-facing, but given low EPSS, no KEV, a single low-footprint product, and unverified RCE claims, this is a moderate, targeted-risk issue rather than a widespread emergency.

An attacker with network access to the CH22's web management interface sends a crafted HTTP request to /goform/SafeEmailFilter with a malicious 'page' argument, triggering memory corruption in the formSafeEmailFilter handler. Because the exploit has been made public and the CVSS vector indicates no authentication or user interaction and low attack complexity, the request can at minimum crash the device and may allow execution of attacker-controlled code if the overflow is controllable. Exploitation is most practical against devices whose management interface is reachable from the attacker (LAN, or WAN where remote management is enabled).