Tenda CH22 CVE-2025-12322

Exploitation targets the HTTP endpoint /goform/NatStaticSetting (the NAT static-routing/port-forwarding configuration handler) on the Tenda CH22 router version 1.0.0.1, specifically by manipulating the 'page' argument to overflow a buffer in the fromNatStaticSetting function. The CVSS vector's PR:L indicates authenticated access to the router's web management interface is required, so the attacker must possess valid (or default/weak) credentials and network reachability to the admin interface - the primary limiting factors. No end-user interaction is needed (UI:N), and attack complexity is low (AC:L), but exposure is bounded by whether the management interface is reachable from the attacker's position (typically LAN-side unless remote WAN management is enabled).

Signals are largely consistent and point to a moderate, authentication-gated risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack that nevertheless requires low-level privileges (PR:L) - i.e. the attacker must already be authenticated to the device, which meaningfully constrains real-world exploitation to attackers who have valid or default credentials or who can chain an auth bypass. Impact is high across confidentiality, integrity and availability (VC:H/VI:H/VA:H) with no scope change (SC:N/SI:N/SA:N), consistent with a buffer overflow (CWE-119) that could crash the device or, if reliably exploited, run code in the router's context. Publicly available exploit code exists (referenced GitHub issue), and the CVSS 4.0 string carries E:P (proof-of-concept), but this is NOT CISA KEV-listed and EPSS is only 0.79% (55th percentile), so there is no evidence of widespread active exploitation - the combination suggests opportunistic or targeted use at most, not mass exploitation. Note a mild tension: the exploit requires authentication (PR:L) yet SOHO routers of this class frequently ship with weak/default credentials, which can effectively erode that barrier in practice. This is a legitimate patch-when-available item for affected Tenda CH22 owners but not a drop-everything event for most enterprises given the narrow deployment footprint.

An attacker with network access to the router's web management interface and low-level authenticated access sends a crafted request to /goform/NatStaticSetting with a manipulated 'page' argument, triggering a buffer overflow in fromNatStaticSetting. Public proof-of-concept exploit code exists (GitHub reference), lowering the barrier to reproduction, and could be used to crash the device or potentially achieve code execution in the router's context.