Tenda CH22
CVE-2025-12273
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend crafted 'page' argument to /goform/webExcptypemanFilter
-
ExecutionOverflow fixed-size buffer in fromwebExcptypemanFilter
-
ImpactCrash service or execute code on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the router's HTTP management interface and a low-privilege authenticated session (CVSS PR:L), after which the attacker manipulates the 'page' argument of the /goform/webExcptypemanFilter endpoint to overflow the buffer handled by fromwebExcptypemanFilter. No end-user interaction is needed (UI:N) and attack complexity is low (AC:L), so exploitation is reliable once access is obtained. Limiting factors: the authentication requirement means devices that do not expose the web UI to untrusted networks and do not use default/weak credentials are substantially harder to attack; exploitation is tied specifically to firmware version 1.0.0.1 of the Tenda CH22. |
| Impact | Signals are mostly consistent but point to a moderate, not top-tier, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw that nonetheless requires some level of authentication (PR:L), and the high VC:H/VI:H/VA:H impact drives the 7.4 score. A public exploit exists (E:P, confirmed by the referenced GitHub issue), which raises practical concern, but there is NO CISA KEV listing and the EPSS probability is only 1.01% (62nd percentile) - indicating no evidence of widespread active exploitation despite available POC code. The PR:L requirement is the key mitigating factor: an attacker needs valid (even low-privilege) credentials or an authenticated session to the router's web interface, which limits mass internet-wide exploitation against properly secured devices but is weak protection where default/weak credentials are common on SOHO gear. CWE-119 (improper restriction of memory buffer) is consistent with the buffer-overflow description. Net: a genuine, publicly-exploitable flaw worth patching on exposed Tenda CH22 devices, but the authentication gate and low EPSS argue against emergency prioritization over unauthenticated internet-facing criticals. |
| Exploit ScenarioDerived | An attacker with access to the router's web management interface and low-privilege credentials sends a crafted request to /goform/webExcptypemanFilter with a manipulated 'page' argument, overflowing a fixed-size buffer in the fromwebExcptypemanFilter function. A public exploit is available (referenced GitHub issue), enabling denial of service or likely remote code execution on the embedded device. Because AC is low, the manipulation is reliable once the attacker can reach and authenticate to the interface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) allows an attacker with a low-privilege authenticated session on the device's HTTP management interface to manipulate the 'page' argument of the /goform/webExcptypemanFilter endpoint and overflow the buffer handled by fromwebExcptypemanFilter, achieving high impact on confidentiality, integrity, and availability. The issue is remotely reachable (CVSS 4.0 base 7.4; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and does not require user interaction, so exploitation is reliable once access is obtained. Publicly available exploit code exists (a public PoC is linked from the reporting references), but there is no confirmed active exploitation (CISA KEV), and EPSS is moderate at 1.01% (62nd percentile), indicating elevated but not top-tier risk.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available references for Tenda CH22 1.0.0.1; the only vendor-related link is the general Tenda site (https://www.tenda.com.cn/), and the VulDB entries (https://vuldb.com/?id.329945) should be monitored for an updated advisory, with the public PoC at https://github.com/QIU-DIE/CVE/issues/22 available for reproduction and internal testing. Because exploitation requires a low-privilege authenticated session (CVSS PR:L), the highest-value compensating control is to eliminate easy authentication: change any default or weak administrative credentials, enforce unique strong passwords, and disable unused accounts. Restrict or block access to the router's HTTP management interface from WAN/untrusted networks and limit it to a trusted management VLAN or specific admin hosts - the trade-off is that off-site or roaming administration becomes unavailable unless a VPN is used. Where feasible, isolate the device on a segmented network so a successful overflow cannot be leveraged as a pivot into other systems, accepting the added operational complexity of segmentation. Log and alert on repeated POST requests to /goform/webExcptypemanFilter carrying oversized or malformed 'page' values, and plan to replace the device if no patched firmware is published, since end-of-life consumer routers often never receive fixes.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic memory-safety defect (CWE-119, improper restriction of operations within the bounds of a memory buffer) in the firmware of the Tenda CH22, a consumer-class wireless router/access point. The vulnerable code path is the GoAhead-style 'goform' handler reachable at the /goform/webExcptypemanFilter URI, whose implementation function fromwebExcptypemanFilter copies the attacker-controlled 'page' parameter into a fixed-size buffer without performing adequate length validation, producing a buffer overflow. Because the endpoint is part of the device's embedded web management stack and is network-reachable over HTTP, an attacker who can reach the interface and supply an authenticated request can drive the overflow remotely. The affected product is identified by CPE cpe:2.3:o:tenda:ch22_firmware:1.0.0.1, confirming the flaw is tied specifically to firmware release 1.0.0.1. The assessed vector (S:U, C:H/I:H/A:H) indicates that a successful overflow could corrupt memory to the point of full device compromise or denial of service, but that impact remains confined to the router itself rather than crossing a security scope boundary.
Know when Ch22 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint (AV:N) with low complexity (AC:L) but requires an authenticated low-privilege session (PR:L); memory-corruption buffer overflow on an embedded device plausibly yields full C/I/A compromise.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A weakness has been identified in Tenda CH22 1.0.0.1. Affected is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a manipulation of the argument page can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
The Tenda CH22 router running firmware version 1.0.0.1 contains a high-severity buffer overflow that an authenticated low-privilege attacker can use through the HTTP management interface to compromise the device's confidentiality, integrity, and availability. Because publicly available exploit code exists and no vendor-released patch has been identified, organizations using these routers for branch, retail, or remote connectivity face potential network outages, traffic manipulation, and a foothold for lateral movement. Leadership should prioritize inventory and containment of affected devices, especially any with exposed management interfaces, until Tenda provides a fix or devices are replaced.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management interface to trusted networks or VPN, disable WAN and remote management, enforce strong unique credentials, segment affected routers, monitor for exploitation attempts against /goform/webExcptypemanFilter, and isolate or replace Tenda CH22 v1.0.0.1 devices until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Ch22 Firmware
View allStack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to po
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. Rated critical severi
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. Rated critical severity (C
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a
Critical stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1 affecting the /goform/addUserName endpo
Critical stack-based buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1, affecting the formNatl
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exp
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code o
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interf
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interfa
Exploit-DB