Tenda CH22 CVE-2025-15229

Exploitation requires network reachability to the router's HTTP management interface and the ability to send a request to the /goform/DhcpListClient endpoint with a manipulated LISTLEN parameter; no authentication is indicated (PR:N) and no user interaction is required (UI:N). The practical limiting factor is interface exposure: on a Tenda CH22 the web admin service is typically bound to the LAN, so an external attacker usually needs LAN/adjacent access or a router whose management is exposed to the WAN. Impact is limited to availability (device/service crash); there is no data disclosure or modification, and the condition is present in default firmware up to and including version 1.0.0.1.

This is a medium-severity (CVSS 4.0 base 5.5) denial-of-service issue whose only impact is availability (VA:L); there is no confidentiality or integrity exposure, which caps its real-world priority well below a code-execution flaw. The CVSS vector rates it network-exploitable with low complexity and no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), and the E:P (Proof-of-Concept) exploit-maturity value aligns with the input signal that public exploit code exists. The EPSS score of 4.58% sits at a high percentile (91%), indicating more predicted exploitation activity than most CVEs, but in absolute terms a ~5% 30-day probability is still low and does not indicate mass exploitation. It is NOT in CISA KEV, so there is no evidence of confirmed active exploitation despite the available POC - POC availability and active exploitation are distinct signals and should not be conflated. One important caveat: the vector asserts AV:N, but the affected endpoint is a Tenda consumer-router web management function (/goform/DhcpListClient), which in default deployments is typically reachable only from the LAN side rather than the WAN; verify administrative-interface exposure before treating this as a true internet-facing remote DoS. On balance this is a genuine-but-limited LAN-adjacent DoS against a specific SOHO router model, not a high-urgency priority.

An attacker with network access to the router's web management interface sends a crafted request to /goform/DhcpListClient with a manipulated LISTLEN argument, triggering improper resource handling (CWE-404) in the fromDhcpListClient function and crashing or hanging the service. A public proof-of-concept exists, so exploitation requires little skill; given the low attack complexity and no authentication in the CVSS vector, the main practical gate is reaching the management interface, which is usually LAN-side.