Which versions of Tenda CH22 are affected by CVE-2025-12235?

CVE-2025-12235 is a buffer overflow in Tenda CH22 routers (firmware 1.0.0.1) that allows authenticated network attackers to execute arbitrary code and fully compromise router integrity,…

Is there a public PoC exploit available for CVE-2025-12235?

Yes, a public proof-of-concept exploit is available for CVE-2025-12235. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-12235?

Within 24 hours: identify and inventory all Tenda CH22 routers in your environment and verify firmware version (1.0.0.1 is affected). Within 7 days: isolate affected routers from critical network segments, restrict administrative access to trusted personnel only, and monitor for suspicious connection attempts to the /goform/SetIpBind endpoint. Within 30 days: contact Tenda for patch availability timeline; if no patch emerges, evaluate replacement with alternative vendor equipment or permanent air-gapping of affected devices.

Tenda CH22 CVE-2025-12235

Q: What is the CVSS score of CVE-2025-12235?

CVE-2025-12235 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Buffer Overflow (CWE-119)

2025-10-27 cna@vuldb.com

Buffer Overflow Tenda Ch22 Firmware

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:16 vuln.today

DescriptionCVE.org

A vulnerability was found in Tenda CH22 1.0.0.1. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page results in buffer overflow. The attack must originate from the local network. The exploit has been made public and could be used.

AnalysisAI

Buffer overflow in Tenda CH22 router firmware 1.0.0.1 allows authenticated attackers on the adjacent network to execute arbitrary code with high impact to confidentiality, integrity, and availability. The vulnerability exists in the fromSetIpBind function accessible via /goform/SetIpBind endpoint when processing the 'page' parameter. A public proof-of-concept exploit has been published on GitHub, lowering the barrier to exploitation, though no active exploitation has been confirmed by CISA KEV at time of analysis.

Technical ContextAI

This vulnerability affects the fromSetIpBind function in Tenda CH22 router firmware version 1.0.0.1, accessible through the /goform/SetIpBind web interface endpoint. The root cause is CWE-119 (Improper Restriction on Operations within the Bounds of a Memory Buffer), specifically a classic buffer overflow condition when the router processes the 'page' parameter without proper bounds checking. When oversized input is provided to this parameter, it overwrites adjacent memory regions, enabling control of program execution flow. This type of vulnerability is common in embedded device firmware written in memory-unsafe languages like C, particularly in older router models where input validation on web management interfaces may be insufficient. The affected product is a Tenda wireless router, and the vulnerable code resides in the IP binding configuration functionality, which typically allows administrators to map MAC addresses to static IP assignments.

RemediationAI

No vendor-released patch or updated firmware version has been identified in available data sources at time of analysis. Until Tenda releases firmware updates, implement these compensating controls: (1) Restrict access to the router's web management interface to trusted administrator IP addresses only using firewall rules or access control lists - this prevents exploitation from guest networks or compromised IoT devices on the same LAN segment; (2) Change default administrative credentials to strong unique passwords to raise the authentication barrier (PR:L requirement); (3) Disable remote management features and ensure management interface is only accessible from trusted wired connections, not wireless networks; (4) Segment the network so that guest/IoT devices cannot reach the router management interface on adjacent network segments; (5) Monitor router logs for unusual access patterns to /goform/SetIpBind endpoint. Note that access restrictions may impact legitimate remote administration workflows. Organizations with high-risk exposure should consider replacing affected devices with alternative router models that receive active security updates, as Tenda's patch release timeline is unknown. Check https://www.tenda.com.cn/ periodically for firmware updates.