Tenda CH22 CVE-2025-12235

Exploitation requires authenticated access (low-privilege router credentials) AND adjacent network positioning where the attacker can reach the router's management interface on the same LAN segment. The CVSS vector AV:A (Adjacent Network) specifically means the attacker cannot exploit this remotely over the internet - they must be on a network segment that can directly communicate with the router's web management interface, typically achieved through wireless association to the router or connection to a switch/network on the same broadcast domain. The PR:L (Low Privileges Required) indicates valid authentication credentials are necessary, though these need not be administrative - any valid router user account suffices. Exploitation is LIMITED by: (1) requirement for network proximity or VPN/compromised host access to the LAN, (2) need for valid credentials (even low-privilege), and (3) access to the web management interface which may be disabled on wireless networks or restricted by IP-based ACLs in security-conscious deployments. Default configurations that expose the management interface to all LAN-connected devices maximize exploitability.

Real-world exploitation risk is moderate with important caveats. CVSS 4.0 score of 7.3 reflects high technical impact (VC:H/VI:H/VA:H) but important access constraints: AV:A requires adjacent network access (attacker must be on same LAN segment as router's management interface) and PR:L requires low-privilege authentication (valid router credentials). Attack complexity is low (AC:L) with no user interaction required (UI:N), meaning exploitation is straightforward once access prerequisites are met. The Exploit Maturity indicator E:P confirms publicly available proof-of-concept code exists (GitHub repository linked in references), significantly lowering technical barriers for attackers with network access. However, this is NOT in CISA KEV, indicating no confirmed widespread or targeted exploitation in enterprise environments. The adjacent network requirement substantially limits internet-based mass exploitation - attackers need prior LAN access via compromised credentials, guest network access, or physical proximity for wireless access. For organizations using Tenda CH22 routers in production, this warrants prompt attention due to the POC availability and complete system compromise potential, but it's not an internet-wide scanning threat like remotely exploitable router vulnerabilities. Risk is highest in environments where guest networks share router management access or where WPA2 compromise could grant adjacent access.

An attacker who has obtained valid low-privilege credentials to the Tenda CH22 router's web interface (perhaps through password reuse, phishing, or default credentials) connects to the local network either via compromised wireless access or through a guest network that shares the same broadcast domain. Using the publicly available proof-of-concept code from GitHub, the attacker sends a specially crafted HTTP request to the /goform/SetIpBind endpoint with an oversized 'page' parameter value that triggers the buffer overflow in the fromSetIpBind function. This overwrites the return address on the stack, redirecting execution to attacker-controlled shellcode that executes with router firmware privileges, granting complete control over the device including traffic interception, DNS hijacking, firmware persistence, and pivot point for attacking other network devices.