Tenda CH22
CVE-2025-14526
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface with low-priv credentials
-
DeliverySend crafted request to /goform/L7Im
-
ExploitOverflow buffer via oversized 'page' argument
-
ExecutionCorrupt memory in frmL7ImForm handler
-
ImpactCrash device or execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the router's HTTP management interface and, per the provided CVSS 4.0 vector, low-privilege authentication (PR:L); the attacker sends a request to the specific endpoint /goform/L7Im (function frmL7ImForm) with a manipulated 'page' argument to trigger the buffer overflow (CWE-119). No user interaction is required (UI:N) and complexity is low (AC:L). Limiting factors: exploitation is confined to Tenda CH22 firmware 1.0.0.1 specifically, the management interface must be reachable from the attacker (typically LAN-side unless remote admin is enabled), and valid low-level credentials are needed if the PR:L assumption holds - note this authentication requirement should be verified, as many Tenda /goform handlers are reachable pre-authentication, which would remove this constraint. |
| Impact | Signals are moderate and largely consistent. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 7.4 and indicates a network-reachable, low-complexity flaw requiring low-privilege authentication (PR:L) with high impact to confidentiality, integrity, and availability on the vulnerable system (VC:H/VI:H/VA:H), no scope change. The CVSS 4.0 vector explicitly carries E:P (Proof-of-Concept), which matches the input flag that public exploit code exists; however, this is NOT the same as active exploitation. There is no CISA KEV listing, so this is 'publicly available exploit code exists,' not confirmed in-the-wild use. EPSS is low (0.76%, 54th percentile), which is typical for an obscure consumer-router CVE: a working POC is published but mass automated exploitation is not predicted. Net assessment: a genuine but not top-tier priority - real because remote code/crash impact with a public exploit and only low privileges needed, but tempered because the affected product is a single niche Tenda router model/firmware, EPSS is low, and the report originates solely from VulDB (cna@vuldb.com) with no independent vendor confirmation. The PR:L requirement is a notable mitigating factor that should be verified, since many Tenda /goform endpoints are reachable without authentication - if that is the case here, real risk is higher than the vector suggests. |
| Exploit ScenarioDerived | An attacker with network access to the router's web management interface and low-privilege credentials sends a crafted request to /goform/L7Im with a manipulated 'page' parameter, overflowing a buffer in the frmL7ImForm handler. A public proof-of-concept exists (referenced on GitHub), lowering the barrier to reproduction; the low attack complexity (AC:L) means a single malformed request can crash the device or potentially corrupt memory for code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A stack-based buffer overflow in the Tenda CH22 router's HTTP management service (firmware 1.0.0.1) lets an attacker crash or potentially execute code on the device by sending a crafted request to the /goform/L7Im endpoint with an oversized 'page' argument handled by the frmL7ImForm function. The vulnerability is network-reachable (AV:N) with low attack complexity and no user interaction, but per the assessed CVSS 4.0 vector it requires low-privilege authentication (PR:L), so the attacker must either hold valid credentials or reach a handler that is exposed pre-authentication - a constraint worth verifying, since many Tenda /goform handlers are reachable without login. Publicly available exploit code exists (published via a GitHub issue tracked in the NVD references), the EPSS score is 0.76% (54th percentile) indicating modest but non-trivial exploitation likelihood, and there is no CISA KEV listing, so active exploitation in the wild is not confirmed by the available data. Successful exploitation yields high confidentiality, integrity, and availability impact on the router itself, with no assessed impact to downstream connected systems.
RemediationAI
No vendor-released patch was identified in the available intelligence at the time of analysis: the CVE references point to the public exploit write-up (https://github.com/maximdevere/CVE2/issues/5), the VulDB records (https://vuldb.com/?id.335866, https://vuldb.com/?ctiid.335866, https://vuldb.com/?submit.703035), and the Tenda vendor site (https://www.tenda.com.cn/) without a firmware fix version, so owners should check Tenda's support pages directly for a CH22 firmware release newer than 1.0.0.1 and apply it as soon as one is published. Until then, apply compensating controls: disable WAN-side/remote administration and UPnP port-mapping that would expose the web UI beyond the LAN, accepting that this breaks remote management and some plug-and-play connectivity; change the default administrative password and enforce a strong, unique credential so the PR:L requirement cannot be met with a stock login, though note this only holds if the handler is genuinely not pre-authentication; where the L7IM/application-filtering feature is not needed, disable or avoid the layer-7 IM filtering configuration so the vulnerable form is not exercised, at the cost of losing that traffic-control capability; place the router's management interface behind a trusted VLAN or firewall rule that permits only known admin hosts, which sacrifices convenient management from arbitrary LAN clients; and monitor or block POST requests to /goform/L7Im carrying uncommonly long 'page' values (a signature-level WAF/reverse-proxy rule on any fronting appliance) as a detection and containment measure, understanding that such filtering is bypassable via encoding and does not fix the underlying memory-safety defect. Because a public exploit exists and exploitation requires only network reachability plus, per the assessed vector, low-privilege credentials, prioritise isolation of the management plane and, if the device cannot be updated, consider replacing or retiring the affected unit.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-119 improper-restriction-of-operations-within-the-bounds-of-a-memory-buffer (buffer overflow) in the embedded HTTP daemon that serves Tenda CH22 firmware 1.0.0.1 (CPE: cpe:2.3:o:tenda:ch22_firmware:1.0.0.1:*:*:*:*:*:*:*). The vulnerable code path is the frmL7ImForm form handler reached through the /goform/L7Im URI; the 'page' parameter is copied into a fixed-size buffer without adequate length validation, so an over-long value overflows adjacent memory. The 'L7Im' form is part of the device's layer-7 application/IM traffic filtering configuration, meaning the endpoint is part of the normal administrative web UI rather than a rarely used service. Because this is firmware-resident, embedded C code, there is typically no memory-safe language runtime or automatic bounds enforcement to blunt the overflow; outcomes range from an immediate denial of service (httpd crash/device reboot) to control-flow hijacking leading to code execution under the web server's privileges if the memory layout can be reliably shaped. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, high VC/VI/VA, no subsequent-system impact) describes remote reachability with low complexity, no user interaction, and low-privilege authentication as the only gate, which aligns with the shared /goform dispatch model used across Tenda consumer routers and with the independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Know when Ch22 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable goform endpoint with low complexity; PR:L retained per input as the web UI typically requires low-level auth; full memory-corruption impact gives C/I/A:H, no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a manipulation of the argument page results in buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Executive ViewAI
Tenda CH22 routers running firmware 1.0.0.1 contain a high-severity buffer overflow that could allow an authenticated attacker to disrupt or take control of the device. Organizations using these routers in their network infrastructure face potential service outages or network compromise, especially if administrative credentials are weak or the management interface is internet-facing. Immediate action is needed to locate and secure these devices due to publicly available exploit code.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting management interface access to trusted networks, enforcing strong authentication, monitoring for exploitation attempts, and isolating affected devices through network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Ch22 Firmware
View allStack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to po
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. Rated critical severi
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. Rated critical severity (C
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a
Critical stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1 affecting the /goform/addUserName endpo
Critical stack-based buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1, affecting the formNatl
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exp
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code o
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interf
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interfa
Exploit-DB