Tenda CH22
CVE-2025-12271
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliverySend oversized 'page' param to /goform/RouteStatic
-
ExploitOverflow buffer in fromRouteStatic
-
ExecutionHijack control flow / crash service
-
ImpactExecute code or deny service on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the router's web management endpoint /goform/RouteStatic and sending a malicious 'page' argument to the fromRouteStatic handler; per the CVSS PR:L metric an authenticated (low-privilege) session on the device is needed, so it is not fully unauthenticated. Limiting factors: the attacker must have valid web-UI credentials (often default or weak on SOHO routers) and network reachability to the management interface - which by default is LAN-side, so internet exploitation depends on the admin panel being exposed to the WAN. Affected scope is narrow: Tenda CH22 firmware 1.0.0.1 specifically. |
| Impact | Signals are moderate and broadly self-consistent. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H/VA:H yields the 7.4 score and describes a network-reachable, low-complexity attack requiring low privileges (PR:L = an authenticated session on the router). A public proof-of-concept exists (GitHub issue), raising practical risk, but this is distinct from active exploitation - the CVE is NOT on the CISA KEV list, so there is no confirmed in-the-wild use. EPSS is 1.01% (62nd percentile), which is low-to-moderate and typical of a freshly disclosed SOHO-router bug with a POC but no mass-exploitation tooling. The description states 'The attack can be launched remotely,' consistent with AV:N, but the PR:L requirement means an attacker must first obtain valid (often default/weak) credentials to reach the /goform/RouteStatic endpoint - a meaningful limiting factor against untargeted internet-wide attacks. Net: this is a real but mid-tier priority - patch/mitigate on exposed devices, but it is not a drop-everything emergency. No SSVC decision data was supplied in the input, so automatable/technical-impact framing could not be cross-referenced. |
| Exploit ScenarioDerived | An attacker with access to the router's web management interface (via weak/default credentials or an exposed WAN panel) sends a crafted request to /goform/RouteStatic with an oversized 'page' argument, triggering a buffer overflow in fromRouteStatic. A public proof-of-concept is available, lowering the skill barrier; successful exploitation can crash the device or potentially achieve code execution in the router's context. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Buffer overflow in Tenda CH22 firmware 1.0.0.1 lets an authenticated remote attacker corrupt memory in the fromRouteStatic handler of the /goform/RouteStatic web endpoint by submitting an oversized 'page' argument, yielding high impact to the device's confidentiality, integrity, and availability (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploit code is publicly available (a GitHub PoC linked from the NVD entry), but there is no confirmation of active exploitation - the CVE is not in CISA KEV - and EPSS is only about 1.01% (62nd percentile), so predicted exploitation activity is moderate. Successful abuse requires a valid low-privilege web-UI session per the PR:L metric plus network reachability to the management interface, which on this SOHO router is LAN-side by default and only internet-reachable if the admin panel has been exposed to the WAN.
RemediationAI
No vendor-released patch identified at time of analysis - the reference set contains only VulDB records and the Tenda homepage (https://www.tenda.com.cn/), with no fixed firmware version published, so operators should check Tenda's support site and the VulDB entry https://vuldb.com/?id.329943 for any future advisory. Until a fix ships, apply compensating controls: keep the CH22 web management interface off the WAN (disable remote administration and block inbound access to the management port at the perimeter firewall), which eliminates the realistic remote attack path at the cost of losing out-of-band administration; restrict the management UI to a trusted LAN segment or management VLAN, accepting that any host on that segment with credentials can still reach /goform/RouteStatic; replace default or weak admin credentials with strong unique ones and, if the firmware supports it, create a non-default account, noting that weak credentials are the main obstacle an attacker must overcome given the PR:L requirement; and, where operationally feasible, filter or reject HTTP requests to /goform/RouteStatic that carry an abnormally long 'page' parameter (via a reverse proxy, WAF, or IDS/IPS rule), accepting that this is signature-based and may miss payload variations or be bypassed by encoding tricks. Because overflow attempts commonly crash the web daemon before any code execution, monitor device logs and uptime for repeated management-plane restarts as an exploitation indicator, and consider retiring or isolating the device if no firmware fix becomes available.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic memory-safety defect (CWE-119, improper restriction of operations within the bounds of a memory buffer) in Tenda CH22 firmware version 1.0.0.1, matching CPE cpe:2.3:o:tenda:ch22_firmware:1.0.0.1:*:*:*:*:*:*:*. Tenda's embedded management interface exposes CGI-style handlers under /goform/, and the fromRouteStatic handler processes the user-supplied 'page' parameter without adequately validating its length before copying it into a fixed-size buffer, producing a buffer overflow (most likely stack-based) in the router's HTTP daemon. Because the vulnerable code runs in the web server process with elevated privileges on the device, a successful overflow can crash the router (denial of service) and, with a crafted payload, potentially redirect execution and compromise the device. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, E:P) and the independent 3.1 assessment both agree that the attacker needs authenticated network access to the management endpoint rather than being fully unauthenticated, and that the impact is confined to the CH22 device itself (subsequent system S:N).
Know when Ch22 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable /goform endpoint (AV:N/AC:L) but requires a low-privilege authenticated web session (PR:L); memory-corruption overflow can yield full device C/I/A compromise with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was identified in Tenda CH22 1.0.0.1. This affects the function fromRouteStatic of the file /goform/RouteStatic. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.
Executive ViewAI
A high-severity memory corruption flaw in Tenda CH22 router firmware (version 1.0.0.1) allows anyone holding a valid low-privilege web management session to crash or potentially take control of the device through the RouteStatic configuration endpoint. Because the affected management interface is normally confined to the local network, the exposure is concentrated in branch offices, retail sites, and remote or home workers using this model, where a compromised or insider-held session could let an attacker disrupt connectivity and tamper with routing configuration. Leadership should care because many organizations run this class of low-cost edge device unmanaged and unpatchable, and a single hijacked router can silently redirect or intercept traffic for everyone behind it.
No vendor-released patch identified at time of analysis. Publicly available exploit code exists, but exploitability depends on an attacker already holding a valid low-privilege web session and reaching the LAN-side management interface. Interim mitigations: block WAN access to the router admin panel, restrict /goform/RouteStatic to trusted administrative hosts, segment devices onto an isolated VLAN, rotate credentials and enforce least-privilege accounts, disable unused remote management features, and monitor for abnormal router reboots, config changes, or traffic redirection pending hardware replacement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Ch22 Firmware
View allStack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to po
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. Rated critical severi
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. Rated critical severity (C
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a
Critical stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1 affecting the /goform/addUserName endpo
Critical stack-based buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1, affecting the formNatl
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exp
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code o
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interf
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interfa
Exploit-DB