Tenda CH22
CVE-2025-12236
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface over network
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend crafted 'page' argument to /goform/DhcpListClient
-
ExecutionOverflow buffer in fromDhcpListClient
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Tenda CH22 (firmware 1.0.0.1) web management interface and the ability to reach the /goform/DhcpListClient endpoint, then supplying a malicious 'page' argument to the fromDhcpListClient handler. The assigned CVSS vector's PR:L indicates a low-privilege authenticated session to the web UI is needed, which limits exploitation to attackers who can reach the interface (typically LAN-side, or WAN-side only if remote management is enabled) and who possess or can obtain valid credentials. Limiting factors: dependence on exposure of the management interface, the authentication requirement (per vector, not confirmed by description), and the narrow affected version 1.0.0.1. |
| Impact | Multiple signals converge on a moderate-but-credible risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity flaw requiring only low-level privileges and no user interaction, with high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) but no scope change to other systems (SC:N). A publicly available exploit exists (GitHub issue by QIU-DIE), and EPSS is 3.49% at the 89th percentile - elevated relative to most CVEs and consistent with public POC availability, though still far from mass-exploitation levels. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation; the elevated EPSS percentile plus public POC suggests opportunistic rather than confirmed widespread abuse. The practical risk is tempered by PR:L (authentication/session to the router web interface is required per the assigned vector) and by the product being a specific consumer router model rather than ubiquitous infrastructure. Net: a real, actionable issue for anyone running the affected Tenda CH22 firmware, but not a drop-everything emergency on the level of a KEV-listed, unauthenticated RCE. Note: the description says 'Remote exploitation is possible' but does not itself mention authentication - the PR:L (authenticated) qualifier comes solely from the VulDB-assigned CVSS vector and should be verified against the actual device behavior. |
| Exploit ScenarioDerived | An attacker with network reachability to the Tenda CH22 router's web management interface and a low-privilege session sends a crafted request to /goform/DhcpListClient with an oversized or malformed 'page' argument, triggering a buffer overflow in the fromDhcpListClient function. This can crash the device (denial of service) or potentially lead to arbitrary code execution on the router. A public exploit for this flaw has already been disclosed, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code on the device by sending a crafted 'page' argument to the fromDhcpListClient handler reached through the /goform/DhcpListClient web endpoint. Per the assigned CVSS vector (PR:L), exploitation requires a low-privilege authenticated session on the web management interface, so the practical attack surface is limited to parties who can reach that interface (typically LAN-side, or WAN-side if remote management is enabled) and who hold valid credentials. Publicly available exploit code exists (a proof-of-concept linked from the advisory), and EPSS sits at 3.49% (89th percentile), indicating elevated relative interest, though there is no confirmed active exploitation (not in CISA KEV). The independent assessment rates the overall risk as moderate but credible, driven by the authentication prerequisite and the narrow affected firmware version rather than by confirmed in-the-wild activity.
RemediationAI
No vendor-released patch was identified at time of analysis, so operators must rely on compensating controls until Tenda publishes fixed firmware for CH22 1.0.0.1. Prioritize limiting reachability of the management interface: disable WAN-side remote management so the web UI and /goform/DhcpListClient are only reachable from the trusted LAN, and, where the device supports it, restrict administrative access to specific management IPs or hosts - the trade-off is that remote administration becomes unavailable and all changes must be made locally. Replace default and weak administrative credentials with strong unique ones, since the assessed vector (PR:L) means the attacker still needs a valid low-privilege session; this does not eliminate the flaw but raises the bar. If the DHCP client list / /goform/DhcpListClient functionality is not required, block or filter access to the /goform/* endpoints at an upstream firewall or reverse proxy, accepting that related configuration pages may break. Because a public proof-of-concept exists, monitor Tenda's site (https://www.tenda.com.cn/) and the referenced VulDB advisories (https://vuldb.com/?id.329906) for a firmware update, and plan to upgrade CH22 promptly once a fixed firmware revision is released; if no fix becomes available and the risk is unacceptable, consider replacing the device.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the DHCP client list functionality of the Tenda CH22 router firmware, specifically the fromDhcpListClient function served through the /goform/DhcpListClient HTTP handler on the device's embedded web management interface. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) is the root-cause class: user-supplied input to the 'page' argument is not adequately length-checked or bounds-validated before being copied into a fixed-size memory buffer, allowing attacker-controlled data to overwrite adjacent memory. Because the code runs on a resource-constrained embedded router, such overflows commonly lead to process crashes or memory corruption that can, depending on layout and mitigations, be leveraged for control-flow hijacking. The CPE cpe:2.3:o:tenda:ch22_firmware:1.0.0.1 confirms the scope is the firmware image for the CH22 device at version 1.0.0.1. The assigned CVSS 4.0 score of 7.4 and the independent CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) both describe high confidentiality, integrity, and availability impact under network reachability with a low-privilege authenticated session.
Know when Ch22 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint (AV:N) with no special complexity (AC:L); PR:L reflects the authenticated web session indicated by the source vector; memory-corruption RCE yields full C/I/A impact without scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was determined in Tenda CH22 1.0.0.1. This issue affects the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Executive ViewAI
A high-severity buffer overflow affects Tenda CH22 routers running firmware version 1.0.0.1, the type of low-cost device commonly deployed at branch offices, retail sites, and home-office connections. An attacker who already holds valid low-privilege credentials on the device's web management interface could crash the device, disrupting connectivity for everyone behind it, or potentially run code on it, which would place that network segment under adversary control. Leadership should care because the device typically sits at the edge of a trusted network, no vendor patch is yet available, and publicly available exploit code exists, so remediation depends on network isolation and credential hygiene rather than a simple update.
No vendor-released patch identified at time of analysis. Interim mitigations: disable remote/WAN management so the web interface is LAN-only, restrict administrative access to a dedicated management VLAN with strict ACLs, enforce unique strong credentials and remove default accounts, segment the routers away from sensitive systems, monitor logs for anomalous requests to /goform/DhcpListClient, and plan replacement or retirement of the affected units.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Ch22 Firmware
View allStack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to po
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. Rated critical severi
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. Rated critical severity (C
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a
Critical stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1 affecting the /goform/addUserName endpo
Critical stack-based buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1, affecting the formNatl
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exp
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interf
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interfa
Buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) allows an attacker with a low-privilege authenticate
Exploit-DB