Tenda CH22
CVE-2025-12272
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliverySend crafted /goform/addressNat request
-
ExploitOverflow buffer via 'page' argument
-
ExecutionExecute code or crash device
-
ImpactCompromise network gateway
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device's HTTP management interface and the privilege level implied by PR:L - i.e., the attacker must be able to reach and authenticate to (or otherwise access) the CH22 web administration service that exposes /goform/addressNat. The specific trigger is supplying a manipulated 'page' argument to the fromAddressNat handler. Limiting factors: the web interface is typically bound to the LAN side on consumer routers, so remote internet-facing exploitation depends on the admin interface being exposed to the WAN (non-default on most deployments); the required low-privilege authentication further restricts fully unauthenticated attacks. Affected scope is confined to CH22 firmware 1.0.0.1. |
| Impact | Signals are mixed and lean toward a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable buffer overflow with low attack complexity and no user interaction, but PR:L means some level of authentication to the device web interface is required, which meaningfully narrows the exploit population. The vulnerable-system impact is rated high across confidentiality, integrity, and availability (VC:H/VI:H/VA:H), consistent with memory corruption leading to device compromise or crash. Against this, the EPSS score is low at 0.75% (54th percentile), indicating no statistical signal of mass exploitation despite public exploit code existing (E:P). This vulnerability is NOT in CISA KEV - no confirmed active exploitation. The combination of 'public PoC exists but EPSS low and no KEV' suggests opportunistic or proof-of-concept interest rather than widespread automated attacks at this time. Note also that this is a VulDB/CNA-assigned entry (cna@vuldb.com) for a consumer router with a vendor (Tenda) that historically does not issue CVE-tracked patch advisories, so remediation certainty is low. CVSS 4.0 severity here is High (7.4), but the real-world priority is tempered by the authentication requirement, low EPSS, absence of KEV, and the niche affected product. |
| Exploit ScenarioDerived | An attacker with access to the Tenda CH22 web management interface (PR:L) sends a crafted HTTP request to /goform/addressNat with an oversized or malformed 'page' argument, triggering a buffer overflow in the fromAddressNat function. Public exploit code is available, lowering the barrier to reproduction. Successful exploitation can crash the device or potentially achieve code execution on the router, enabling full compromise of the gateway. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
An authenticated buffer overflow in the Tenda CH22 router's web management service (firmware 1.0.0.1) lets an attacker who can reach and log in to the device's HTTP interface corrupt memory via the 'page' argument to the /goform/addressNat handler, with the potential for code execution or denial of service. Publicly available exploit code exists (a PoC is published on GitHub), though exploitation requires network reachability to the admin interface and the low-privilege authentication implied by the PR:L vector; no CISA KEV entry confirms active exploitation, and EPSS is low at roughly 0.75% (54th percentile). Exposure is confined to CH22 firmware 1.0.0.1, and because the web UI is normally LAN-bound, real-world risk is moderate unless remote administration has been exposed to the WAN.
RemediationAI
No vendor-released patch was identified at the time of analysis, so operators of Tenda CH22 firmware 1.0.0.1 should first check https://www.tenda.com.cn/ for a newer firmware image and apply it if one becomes available. Until then, the highest-value control is to ensure the device's HTTP administration interface is not reachable from the WAN: disable remote/cloud management, keep the router behind NAT, and confirm port 80/443 on the device is not port-forwarded or UPnP-exposed, recognizing that this blocks legitimate remote administration. Restrict management access to trusted LAN hosts via VLAN segmentation or management ACLs, and change any default administrator credentials to strong, unique ones, since the assessed vector (PR:L) requires at least low-privilege access - this reduces but does not eliminate risk from an attacker who obtains credentials or a foothold on the LAN. Because a public PoC exists, add detection for POST requests to /goform/addressNat carrying an abnormally long 'page' parameter (or unusually large bodies) and for unexpected reboots/crashes of the device, and consider blocking or rate-limiting that path at an upstream WAF or reverse proxy - with the trade-off that legitimate NAT/address configuration through that page may be disrupted. If the device cannot be isolated or monitored, treat it as untrusted and plan replacement; no vendor workaround was published with the advisory.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic memory-safety defect (CWE-119, improper restriction of operations within the bounds of a memory buffer) in the Tenda CH22 router firmware, specifically in the fromAddressNat function that backs the /goform/addressNat endpoint of the embedded HTTP management service. The 'page' parameter supplied in the request is copied without adequate length validation into a fixed-size buffer, so an oversized value overwrites adjacent memory and can subvert control flow. This is a common pattern in consumer/embedded router web stacks (often GoAhead or a vendor-customized httpd), where CGI-style form handlers trust client input. The affected scope is precisely identified by the CPE cpe:2.3:o:tenda:ch22_firmware:1.0.0.1, meaning only CH22 devices running firmware 1.0.0.1 are in scope. The assessed impact (C:H/I:H/A:H, S:U) indicates that a successful overflow can compromise confidentiality, integrity, and availability of the device itself, plausibly yielding code execution in the context of the web service (typically root on such devices) or a persistent denial of service from a crash/reboot loop.
Know when Ch22 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable goform endpoint (AV:N/AC:L) but requires authenticated access to the web UI (PR:L); buffer overflow yields device-level code execution and crash, so C/I/A:H with unchanged scope.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security flaw has been discovered in Tenda CH22 1.0.0.1. This impacts the function fromAddressNat of the file /goform/addressNat. Performing a manipulation of the argument page results in buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Executive ViewAI
Tenda CH22 routers running firmware 1.0.0.1 have a high-severity authenticated vulnerability in their web management service, and publicly available exploit code exists, creating a potential path to code execution or denial of service for organizations using these devices. The practical risk is greatest where the router admin interface is reachable from untrusted networks or protected only by weak credentials; LAN-only deployments face lower but still meaningful exposure. Because no vendor-released patch has been identified, leadership should treat this as a lifecycle and attack-surface risk requiring near-term mitigation and potential device replacement.
No vendor-released patch identified at time of analysis. Interim mitigations: disable WAN/remote management and block external access to the web interface; restrict the management UI to a trusted, isolated VLAN; enforce strong unique admin credentials and least-privilege accounts; monitor for attempts to /goform/addressNat with suspicious 'page' parameters; deploy IPS/WAF virtual patching if available; and replace or retire affected CH22 firmware 1.0.0.1 devices if mitigation cannot be assured.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Ch22 Firmware
View allStack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to po
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. Rated critical severi
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. Rated critical severity (C
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a
Critical stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1 affecting the /goform/addUserName endpo
Critical stack-based buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1, affecting the formNatl
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exp
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code o
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interf
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interfa
Exploit-DB