Tenda CH22
CVE-2025-12265
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web interface
-
DeliverySend crafted request to /goform/VirtualSer
-
ExploitOverflow buffer via oversized 'page' argument
-
ExecutionExecute arbitrary code on device
-
ImpactCompromise router and intercept traffic
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated access (PR:L) to the Tenda CH22 web management interface and the ability to reach the /goform/VirtualSer endpoint, then submission of a malicious oversized 'page' argument to the fromVirtualSer handler. The attack is remote/network-based (AV:N) with low complexity and no user interaction. The principal limiting factor is the authentication requirement - an attacker must possess or obtain valid management credentials first; on these consumer routers this is often eased by default or weak passwords and by the admin interface being exposed on the LAN or, in misconfigured cases, the WAN. Affected build is confirmed only for CH22 firmware 1.0.0.1. |
| Impact | Signals are mixed and point to a moderate, not top-tier, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack that nonetheless requires some level of authentication (PR:L), with full high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) scored at 7.4. A public POC exists (GitHub issue), which raises practical exploitability, but the EPSS probability is only 1.04% (63rd percentile), indicating no evidence of broad automated exploitation yet. Critically, this is NOT on the CISA KEV list, so despite the public exploit there is no confirmed active exploitation. The PR:L requirement is the key mitigating factor: an attacker must first authenticate to the router's web interface - though on consumer Tenda devices this bar is frequently low due to default or weak credentials and LAN exposure. Net assessment: a real but second-tier issue - credible exploit code and full-impact RCE-class potential, offset by the authentication prerequisite, modest EPSS, absence from KEV, and the limited deployment footprint of this specific SOHO router model. |
| Exploit ScenarioDerived | An attacker with authenticated access to the Tenda CH22 web management interface (e.g., via default/weak credentials on a LAN-exposed or internet-exposed admin panel) sends a crafted request to /goform/VirtualSer with an oversized or malicious 'page' argument, triggering a buffer overflow in the fromVirtualSer function. A public proof-of-concept exists, lowering the skill required; successful exploitation can crash the device or lead to code execution on the router, compromising all traffic behind it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interface via the /goform/VirtualSer endpoint's fromVirtualSer function, leading to high impact on confidentiality, integrity, and availability. The vulnerability requires valid management credentials (PR:L) and network access to the device's web interface, but is low-complexity and needs no user interaction. Publicly available exploit code exists, though EPSS is only 1.04% (63rd percentile), indicating moderate exploitation likelihood; no active exploitation has been confirmed in CISA KEV.
RemediationAI
No vendor-released patch has been identified at time of analysis. Administrators should immediately restrict access to the router's web management interface: disable WAN-side remote management, ensure the admin interface is only reachable from trusted internal networks, and change default credentials to strong, unique passwords. Network segmentation and firewall rules blocking external access to the management port (typically 80/443) are recommended. Monitor for signs of compromise such as unexpected reboots, crashes, or unusual outbound traffic. Check the Tenda website (https://www.tenda.com.cn/) for firmware updates and apply them when available. Trade-offs: restricting management access may hinder remote administration; consider using VPN for remote access. Since a public exploit exists, prioritize these mitigations on internet-exposed devices.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2025-12265 is a classic buffer overflow (CWE-119) in the fromVirtualSer function of the /goform/VirtualSer endpoint in Tenda CH22 firmware 1.0.0.1. The web management interface, likely implemented as a CGI binary, fails to validate the length of the user-supplied 'page' argument before copying it into a fixed-size buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. The CPE cpe:2.3:o:tenda:ch22_firmware:1.0.0.1:*:*:*:*:*:*:* confirms the affected version. Exploitation occurs over HTTP(S) to the router's management port and requires prior authentication (PR:L) as indicated by the CVSS vector. The independent assessment reinforces this with an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Know when Ch22 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable (AV:N) buffer overflow needing authenticated web-UI access (PR:L), low complexity, no interaction; memory-corruption RCE-class flaw warrants C:H/I:H/A:H.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
A high-severity buffer overflow in the Tenda CH22 web management interface (firmware 1.0.0.1) can be triggered by an authenticated remote attacker, putting the confidentiality, integrity, and availability of the device and the network segment it serves at risk. With publicly available exploit code exists and no vendor-released patch identified at time of analysis, any organization running these units in branch, retail, or remote-site roles retains unmitigated exposure until the devices are isolated or replaced. This is primarily an asset-lifecycle and network-segmentation exposure rather than a routine patch-management item, and leadership should care because these devices often sit at the edge of trusted internal networks.
No vendor-released patch identified at time of analysis. Interim mitigations: disable remote/WAN management and restrict the web interface to trusted administrative subnets via firewall or ACL rules; enforce unique, strong management credentials and remove defaults; isolate affected CH22 devices on a dedicated VLAN with no unnecessary access to internal systems; monitor and alert on anomalous requests to the /goform/VirtualSer endpoint; and plan replacement or decommissioning of unsupported units. Apply vendor patch when an exact fixed firmware version is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Ch22 Firmware
View allStack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to po
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. Rated critical severi
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. Rated critical severity (C
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a
Critical stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1 affecting the /goform/addUserName endpo
Critical stack-based buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1, affecting the formNatl
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exp
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code o
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interf
Buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) allows an attacker with a low-privilege authenticate
Exploit-DB