Tenda CH22
CVE-2025-12234
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web UI on LAN
-
DeliveryAuthenticate with low-privilege/default credentials
-
ExploitSend crafted /goform/SafeMacFilter request with oversized 'page'
-
ExecutionOverflow buffer in fromSafeMacFilter
-
ImpactCrash service or execute code on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the device's web management interface (/goform/SafeMacFilter) - in practice this is the LAN-side admin interface of the Tenda CH22 router, not an internet-facing service by default. The CVSS vector specifies PR:L, so a low-privilege authenticated session (e.g., default or weak admin credentials to the web UI) is needed; no user interaction is required (UI:N). Exploitation targets firmware version 1.0.0.1 specifically and consists of supplying an oversized 'page' argument to the SafeMacFilter handler. Limiting factors: attacker must be able to reach and authenticate to the admin panel, which typically means local-network presence rather than remote internet exploitation. |
| Impact | The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) yields 7.4 and indicates a network-reachable, low-complexity flaw requiring low-privilege authentication, with high confidentiality/integrity/availability impact and no scope change. POC/exploit code is publicly available (referenced GitHub issue QIU-DIE/CVE #15), raising practical risk above a theoretical finding. However, this is reported by vuldb.com (cna@vuldb.com), a source that routinely auto-generates high impact ratings for SOHO-router /goform overflows; the claimed VC:H/VI:H/VA:H (full RCE) is optimistic - many such 'page'-argument stack overflows in Tenda web handlers realistically produce a crash/reboot (DoS) rather than reliable code execution, so the true integrity/confidentiality impact may be lower. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided. The AV:N rating is also worth scrutiny: router admin interfaces are typically reachable from the LAN, so real-world exploitation usually requires an attacker already on the local network rather than true internet-wide reach. Net: publicly disclosed with working PoC, but it is not confirmed actively exploited, affects a niche consumer device, and its practical impact is likely narrower than the CVSS suggests. |
| Exploit ScenarioDerived | An attacker with access to the Tenda CH22 web administration interface (typically on the local network, with low-privilege/default credentials) sends a crafted request to /goform/SafeMacFilter with an oversized 'page' parameter, overflowing a buffer in the fromSafeMacFilter handler. This crashes the service (denial of service) or, if the overflow is controllable, may lead to code execution on the device. Public exploit code for this issue has been disclosed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interface to corrupt memory by supplying an oversized 'page' argument to /goform/SafeMacFilter, potentially enabling arbitrary code execution or denial of service. Exploitation requires low-privilege authentication (CVSS PR:L) and network reachability to the device's admin panel, which is typically restricted to the LAN side. Publicly available exploit code exists; no vendor patch has been identified at time of analysis, and no active exploitation in the wild has been confirmed.
RemediationAI
No vendor-released patch has been identified at time of analysis. Until Tenda issues a firmware update, administrators should apply compensating controls: immediately change the default admin credentials to a strong, unique password to raise the authentication bar, though this will not stop an attacker who already possesses valid low-privilege credentials. Disable WAN-side remote management and ensure the web interface is reachable only from trusted LAN segments-this prevents external exploitation but means management must be performed on-site. Restrict access to the /goform/SafeMacFilter endpoint via firewall rules or network segmentation where possible, and monitor HTTP requests for abnormally long 'page' parameters that could indicate exploitation attempts. If the device cannot be adequately isolated or updated, consider replacing it with a supported model. Check the vendor site https://www.tenda.com.cn/ periodically for firmware updates, and refer to the public exploit link https://github.com/QIU-DIE/CVE/issues/15 for technical details to inform detection engineering.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an instance of CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) in the fromSafeMacFilter handler of Tenda CH22 firmware 1.0.0.1, which is exposed through the embedded web server at /goform/SafeMacFilter. The handler processes the 'page' request parameter without validating its length before copying it into a fixed-size buffer, allowing an attacker to overwrite adjacent memory. Successful corruption can redirect control flow, leading to remote code execution or a crash (denial of service). Per the CVSS vector, the attacker must be authenticated with low privileges (PR:L) and network access to the management interface is required, but no user interaction is needed. The CVSS 3.1 assessment confirms high confidentiality, integrity, and availability impact with no scope change, and the CPE cpe:2.3:o:tenda:ch22_firmware:1.0.0.1 identifies the exact affected firmware. The CVSS 4.0 vector additionally notes exploit maturity (E:P), consistent with the publicly disclosed PoC.
Know when Ch22 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Web-reachable handler needs an authenticated low-priv session (PR:L); impact kept high per report though a crash-only (A:H, lower C/I) outcome is plausible for this overflow.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argument page leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Tenda CH22 routers running firmware 1.0.0.1 - small-office and remote-site edge devices commonly deployed with minimal oversight - carry a high-severity memory corruption flaw in their web management interface. An attacker who already holds low-privilege credentials on the device's admin panel and can reach it over the local network could crash the device or potentially execute code on it, while publicly available exploit code lowers the skill barrier for doing so. Leadership should care because these devices typically sit on trusted internal segments, and a compromised unit can disrupt connectivity, expose internal traffic, or serve as a foothold for lateral movement; however, the exposure is limited to networks where an attacker already has authenticated access and LAN reachability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Ch22 Firmware
View allStack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to po
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. Rated critical severi
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. Rated critical severity (C
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a
Critical stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1 affecting the /goform/addUserName endpo
Critical stack-based buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1, affecting the formNatl
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exp
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code o
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interfa
Buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) allows an attacker with a low-privilege authenticate
Exploit-DB