Tenda CH22 CVE-2025-12232

Requires network reachability to the router's HTTP management interface exposing /goform/SafeClientFilter and a low-privilege authenticated session (CVSS PR:L) - not fully unauthenticated. On typical Tenda CH22 deployments the management interface is LAN-side by default, so WAN/remote exploitation depends on remote management (WAN web access) being enabled, which is non-default. Given those conditions, the attacker manipulates the 'page' argument to fromSafeClientFilter to trigger the stack buffer overflow; a public POC (GitHub QIU-DIE/CVE #13) demonstrates the trigger. Limiting factors: valid credentials/session needed, interface must be reachable, and no vendor patch is currently identified so mitigation relies on restricting management-interface exposure.

Signals are moderately elevated but bounded. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 and treats this as a remotely reachable, low-complexity stack buffer overflow requiring authenticated low-privilege access (PR:L) with full local device impact but no scope change. EPSS is notably high at 4.92% (92nd percentile), which is unusual for a VulDB-sourced consumer-router flaw and reflects the public exploit and the well-known pattern of mass-scanned Tenda /goform overflows. POC exploit code is publicly available (GitHub QIU-DIE/CVE issue #13), so exploitation barrier is low, but there is NO CISA KEV listing and no evidence of active exploitation - treat as publicly available exploit code exists, not confirmed in-the-wild use. The main tempering factors: PR:L means the attacker needs valid credentials or an authenticated session to the web management interface, and the AV:N rating assumes the management interface is network-reachable (typically LAN-side on consumer routers unless remote management is enabled). The VC:H/VI:H/VA:H impact is the standard VulDB optimistic full-CIA read for buffer overflows; on MIPS/ARM SOHO firmware these frequently manifest as reliable DoS/crash with code execution being plausible but not always demonstrated. Net: a real, cheap-to-exploit issue for exposed devices, but gated by authentication and typically LAN adjacency, so mid-tier priority rather than a drop-everything emergency.

An attacker with access to the router's web interface (LAN-side, or WAN-side if remote management is enabled) and low-privilege authentication sends a crafted request to /goform/SafeClientFilter with an oversized or malformed 'page' argument, triggering a stack buffer overflow in fromSafeClientFilter. Public POC code exists (GitHub), lowering the effort to reproduce; the overflow at minimum crashes the device (DoS) and may allow arbitrary code execution as the web server process. Because CVSS is AC:L with a public exploit, weaponization against reachable, credentialed-accessible devices is straightforward.