Tenda CH22
CVE-2025-12233
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface over network
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend crafted 'page' value to /goform/SafeUrlFilter
-
ExecutionOverflow buffer in fromSafeUrlFilter
-
PersistCorrupt memory / hijack execution
-
ImpactCompromise or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the router's HTTP management interface and a request to the /goform/SafeUrlFilter endpoint handled by fromSafeUrlFilter, with a manipulated 'page' argument that overflows an internal buffer. Per the supplied CVSS vector (PR:L), a low-privilege authenticated session to the web UI is required, and no user interaction is needed (UI:N); this authentication requirement is the primary limiting factor and is not independently confirmed by the description. The scope is limited to Tenda CH22 devices running firmware 1.0.0.1; devices whose management interface is not exposed to the attacker's network segment are not reachable, which further limits real-world exploitation. |
| Impact | This is a buffer overflow (CWE-119) in the fromSafeUrlFilter handler of the Tenda CH22 router firmware (1.0.0.1), reachable remotely via the /goform/SafeUrlFilter endpoint by manipulating the 'page' argument. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates network-reachable, low-complexity exploitation requiring low privileges (PR:L = an authenticated but low-privilege session), with high impact to confidentiality, integrity, and availability on the device itself and no scope change to other systems. Publicly available exploit code exists (referenced on GitHub), but this CVE is NOT listed in CISA KEV, so the correct status is 'publicly available exploit code exists' - not confirmed active exploitation. The EPSS score of 4.71% sits at the 92nd percentile, which is elevated relative to most CVEs and consistent with public POC availability, but it still reflects only moderate absolute exploitation probability. The main tension is the PR:L requirement: many Tenda /goform buffer-overflow issues are in practice exploitable without authentication, yet the supplied vector asserts low privileges are needed - this should be verified against the actual endpoint auth behavior. Overall this is a genuine, actionable flaw on an exposed device, but its real-world priority is tempered by it being a single consumer/SOHO router model, the PR:L gate, and the absence of KEV listing. |
| Exploit ScenarioDerived | An attacker with network reachability to the router's web management interface (and, per the CVSS vector, a low-privilege authenticated session) sends a crafted request to /goform/SafeUrlFilter with an oversized or malformed 'page' parameter, overflowing a buffer in fromSafeUrlFilter. This can crash the service or, given the high integrity/availability impact rating, lead to control over execution on the device. Public exploit code for this issue has already been published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or potentially execute code on the device by sending a crafted request to the /goform/SafeUrlFilter endpoint with an oversized 'page' argument processed by the fromSafeUrlFilter handler. Per the supplied CVSS vector (PR:L), exploitation requires a low-privilege authenticated session against the router's HTTP management interface, and no user interaction is needed; this authentication prerequisite is the primary limiting factor, and devices whose management interface is not reachable from the attacker's network segment are not exposed. Publicly available exploit code exists (referenced in a public GitHub issue), and EPSS estimates a 4.71% probability of exploitation activity (92nd percentile), though there is no CISA KEV confirmation of active exploitation and no vendor-released patch has been identified at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis, so remediation must rely on exposure reduction and compensating controls: immediately disable remote/WAN administration and UPnP-based management exposure so the HTTP management interface is reachable only from a trusted LAN segment, since the attack requires network access to the web UI (a low-privileged authenticated session is required per the supplied vector, so rotate default and weak admin credentials and enforce strong passwords as a secondary barrier). Where full isolation is not possible, place the device on a dedicated VLAN or management network with strict firewall rules permitting HTTP/HTTPS management only from trusted administrative hosts, and block inbound access to the goform handlers from untrusted segments; note that this limits legitimate remote management but does not remediate the underlying memory-safety flaw. Deploy an IPS/WAF or reverse proxy in front of the management interface with rules that reject oversized or anomalous 'page' parameters to /goform/SafeUrlFilter - this adds latency and can be bypassed by encoding tricks, but raises exploitation cost. Monitor web server logs and network traffic for abnormal POST requests to /goform/SafeUrlFilter and for device crashes/reboots indicative of overflow attempts. Given the public exploit code and the age of this firmware, evaluate replacement of the Tenda CH22 with a supported device if no vendor fix materializes; check https://www.tenda.com.cn/ and the VulDB entry https://vuldb.com/?id.329903 periodically for a fixed firmware release and apply it immediately when available.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the embedded web management stack of the Tenda CH22 router, specifically in the fromSafeUrlFilter function exposed through the /goform/SafeUrlFilter goform handler - the CGI-style interface used by Tenda firmware to process configuration requests from the administrative web UI. The affected code copies the user-controlled HTTP parameter 'page' into a fixed-size internal buffer without validating its length, which is a classic instance of CWE-119 (improper restriction of operations within the bounds of a memory buffer); on this class of embedded MIPS/ARM firmware, such overflows can corrupt the stack and hijack control flow, leading to denial of service or arbitrary code execution in the context of the router's web server process. The vulnerability is scoped to CPE cpe:2.3:o:tenda:ch22_firmware:1.0.0.1, i.e. Tenda CH22 hardware running firmware release 1.0.0.1, and the attack surface is the device's HTTP management interface, which must be reachable over the network for exploitation to succeed. Authentication requirements follow the supplied CVSS vector (AV:N/AC:L/PR:L/UI:N), meaning a low-privileged authenticated session is required rather than unauthenticated access.
Know when Ch22 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable /goform endpoint with low complexity; PR:L retained per supplied vector for authenticated web access; buffer overflow yields full device C/I/A impact with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a manipulation of the argument page can lead to buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.
Executive ViewAI
Tenda CH22 routers running firmware 1.0.0.1 contain a memory corruption flaw in the web management interface that an attacker with a low-privilege login could use to crash the device or potentially run their own code on it. Because these devices sit at the edge of branch, retail, and home-office networks, a successful compromise could disrupt connectivity for everyone behind the router and provide a foothold for reaching internal systems. Leadership should care because no vendor patch has been identified, exploit code is publicly available, and the only meaningful barrier is that the attacker must first obtain valid management credentials and reach the device's admin interface.
No vendor-released patch identified at time of analysis. Interim mitigations: isolate or disable the HTTP management interface from untrusted networks, restrict administration to a dedicated management VLAN with allowlisted source addresses, replace default and shared admin credentials with strong unique passwords, monitor for oversized or malformed requests to /goform/SafeUrlFilter, and replace or retire the device where segmentation and credential hardening cannot be guaranteed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Ch22 Firmware
View allStack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to po
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. Rated critical severi
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. Rated critical severity (C
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a
Critical stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1 affecting the /goform/addUserName endpo
Critical stack-based buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1, affecting the formNatl
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exp
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code o
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interf
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interfa
Buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) allows an attacker with a low-privilege authenticate
Exploit-DB