Tenda CH22
CVE-2025-12274
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliverySend crafted /goform/P2pListFilter request
-
ExploitOverflow buffer via oversized page arg
-
ExecutionExecute code or crash device
-
ImpactFull compromise of router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Tenda CH22 (firmware 1.0.0.1) web management interface and low-privilege authentication (CVSS PR:L) to reach the /goform/P2pListFilter endpoint; the attacker then supplies a crafted 'page' parameter to the fromP2pListFilter handler to overflow a buffer. Limiting factors: valid (even low-privilege) credentials are needed, the flaw is confirmed only for CH22 firmware version 1.0.0.1, and practical remote exploitation depends on the management interface being reachable from the attacker's network position (typically LAN-side unless WAN-side admin access is exposed). |
| Impact | Signals are mixed and point to a moderate, not top-tier, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low privileges, with high impact to confidentiality, integrity and availability of the vulnerable device (VC:H/VI:H/VA:H) - serious on paper for an affected unit. However, EPSS is low at 0.71% (52th percentile), indicating no strong evidence of broad automated exploitation despite the publicly disclosed exploit. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. SSVC-style reasoning: exploitation is 'proof-of-concept' (CVSS E:P and a public PoC on GitHub), technical impact is total for the device, but automatability is constrained by the PR:L authentication requirement. Net assessment: publicly available exploit code exists but no public evidence of in-the-wild use; combined with the low real-world footprint of this specific consumer router model, this is a genuine-but-niche issue rather than a widespread emergency. Note a tension to verify: the description says 'Remote exploitation is possible' while the vendor CVSS requires PR:L (low-privilege authentication) - so 'remote' here means network-reachable by an authenticated user, not fully unauthenticated. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the web management interface of a Tenda CH22 router (e.g., a logged-in user, or via default/weak credentials on an exposed admin panel) sends a crafted request to /goform/P2pListFilter with an oversized or malformed 'page' argument, triggering a buffer overflow in the fromP2pListFilter function. Given CVSS AC:L and the publicly available PoC (GitHub QIU-DIE/CVE issue #23), reliable triggering is plausible, resulting in device crash (denial of service) or potential arbitrary code execution on the router. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A buffer overflow in the Tenda CH22 router web management interface (firmware 1.0.0.1) lets a network-adjacent attacker who holds low-privilege credentials corrupt memory by sending a crafted 'page' parameter to the /goform/P2pListFilter endpoint, which is handled by the fromP2pListFilter function, potentially leading to code execution or device crash. The flaw is not confirmed as actively exploited (no CISA KEV listing), but publicly available exploit code exists and demonstrates the attack, so unpatched, internet- or LAN-exposed management interfaces should be treated as at risk. EPSS is low (0.71%, ~52nd percentile), and the independent assessment rates the issue a moderate priority given the authentication prerequisite and the typically LAN-limited reachability of the management endpoint.
RemediationAI
No vendor-released patch was identified at the time of analysis, so operators of Tenda CH22 devices should assume firmware 1.0.0.1 remains vulnerable and monitor https://www.tenda.com.cn/ and the VulDB entries (https://vuldb.com/?id.329946) for an updated firmware release, applying it as soon as it appears. Until then, apply compensating controls: disable WAN-side/remote administration so the /goform/ management interface is reachable only from a trusted LAN segment (side effect: remote management and cloud/app-based administration stop working), place the device behind a firewall that blocks inbound access to its HTTP management port (side effect: may also block legitimate local web-UI troubleshooting from other subnets), and rotate any default or shared administrator credentials to reduce the pool of low-privilege accounts an attacker could leverage, since exploitation requires authentication. Because the attack arrives as a crafted 'page' parameter in a POST to /goform/P2pListFilter, IDS/IPS rules or reverse-proxy filtering that reject oversized or anomalous parameters on that path can blunt exploitation attempts (side effect: legitimate P2P list operations through the UI may be disrupted). Segmenting the router onto an isolated management VLAN limits lateral movement if the device is compromised; none of these controls eliminate the underlying memory-corruption flaw, so firmware replacement or hardware retirement should be considered if the vendor does not ship a fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tenda CH22 firmware 1.0.0.1 ships an embedded web management server that exposes handler endpoints under /goform/, a convention characteristic of GoAhead-based firmware used across many consumer routers. The vulnerable handler fromP2pListFilter reads the HTTP request parameter 'page' and copies it into a fixed-size memory buffer without validating its length, an instance of CWE-119 (improper restriction of operations within the bounds of a memory buffer). Because the copy occurs in the request-processing path, an oversized 'page' value overwrites adjacent memory, producing a classic stack/heap overflow that on MIPS-class embedded hardware can crash the service or, with careful layout, redirect execution. CPE data confirms the affected target as cpe:2.3:o:tenda:ch22_firmware:1.0.0.1, and the disclosed proof-of-concept (QIU-DIE/CVE issue 23) validates reachability of the endpoint. The assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, consistent with the vendor CVSS 4.0 score of 7.4, indicates a remotely triggerable, high-impact memory-corruption condition but with a low-privilege authentication requirement rather than unauthenticated access.
Know when Ch22 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable endpoint (AV:N) with low complexity (AC:L) but requiring authenticated low-privilege access (PR:L); memory-corruption buffer overflow enables full device code execution, so C/I/A all High.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument page leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Executive ViewAI
A memory-corruption flaw in the Tenda CH22 router's web management interface (firmware 1.0.0.1) could let an attacker with adjacent network access and low-privilege credentials crash the device or potentially execute code on it. Because these routers are frequently deployed as internet-facing or edge devices in branch offices, retail sites, and remote/home offices, a successful attack could disrupt local network connectivity and provide a foothold into the environments behind them. No vendor patch is currently available, so exposure must be managed through network controls and device lifecycle decisions rather than patching.
No vendor-released patch identified at time of analysis. Interim mitigations: remove internet exposure of the web management interface, restrict administrative access to a dedicated management VLAN or jump host, eliminate default/shared credentials and enforce least privilege, disable or block the affected /goform/P2pListFilter endpoint at the network layer if it is not required, enable monitoring for device crashes or unexpected reboots, and prioritize replacement of unsupported units. Publicly available exploit code exists; no confirmed actively exploited (CISA KEV) activity at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Ch22 Firmware
View allStack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to po
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. Rated critical severi
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. Rated critical severity (C
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a
Critical stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1 affecting the /goform/addUserName endpo
Critical stack-based buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1, affecting the formNatl
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exp
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code o
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interf
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interfa
Exploit-DB