Ch22 Firmware EUVD-2025-16934

This vulnerability presents exceptional real-world risk across multiple dimensions: (1) CVSS 8.8 with network-accessible attack vector (AV:N), low attack complexity (AC:L), and low privilege requirement (PR:L) indicates exploitability from unauthenticated network access after authentication—a realistic threat for exposed router interfaces; (2) Public POC availability significantly increases exploitation probability and enables mass scanning/targeting; (3) Stack-based buffer overflow enables arbitrary code execution, satisfying all three impact categories (Confidentiality, Integrity, Availability at HIGH); (4) Embedded device context means no automatic patching and extended vulnerability windows; (5) The PR:L requirement (low privilege) means even guest/limited user accounts can trigger exploitation. While EPSS data is not provided, the combination of public POC, low AC, full code execution impact, and embedded device target suggests EPSS would be critically high (>0.95). This is NOT a theoretical high-CVSS issue—it is a practical, actively exploitable critical vulnerability.

An attacker performs network reconnaissance and identifies a Tenda CH22 router (1.0.0.1) accessible on the target network. The attacker either (a) obtains valid credentials through phishing/social engineering/default credentials, or (b) exploits any unauthenticated endpoint to gain initial access. Once authenticated or with low-privilege guest access, the attacker crafts an HTTP POST request to /goform/addUserName with a maliciously long Password parameter containing shellcode or ROP gadgets. The oversized input triggers a stack buffer overflow, overwriting the return address. Execution is redirected to attacker-controlled code, allowing the attacker to achieve remote code execution on the router. From this position, the attacker can: exfiltrate network traffic, modify router configuration, pivot to internal network devices, establish persistence through firmware modification, or launch attacks against connected clients. Public POC code enables automated scanning and exploitation at scale, making this applicable to thousands of potentially exposed devices. The low attack complexity and PR:L requirement mean exploitation is trivial once credentials are obtained.