Ch22 Firmware EUVD-2025-17025

CVSS 8.8 (High) with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a severe vulnerability requiring low attack complexity and only low privilege (authenticated user) access. However, the PR:L (Privilege Required: Low) requirement significantly reduces real-world risk compared to unauthenticated vulnerabilities. The CVSS vector suggests: (1) Network-accessible attack surface (AV:N); (2) No special conditions required (AC:L); (3) Requires valid credentials but not administrative rights (PR:L); (4) Direct system compromise (C:H/I:H/A:H). The disclosure of public exploit code and KEV listing elevates this from theoretical to actively weaponizable. For an IoT/embedded device like a router, authentication barriers are moderate—many users share credentials or default credentials exist. SSVC considerations: Exploitation is confirmed (public POC), likely automatable at scale, with total technical impact (RCE). Real-world priority: HIGH for organizations managing Tenda CH22 devices, moderate for others. This is not a false-alarm high-CVSS—the barrier (authentication) is meaningful but not insurmountable for motivated threat actors targeting specific networks.

An attacker with valid (possibly default or leaked) router credentials logs into the Tenda CH22 web interface. Instead of using the normal UI, the attacker crafts a malicious HTTP POST request to /goform/Natlimit with an oversized 'page' parameter containing a specially crafted payload (typically shellcode preceded by padding and a return address). The formNatlimit function copies this payload to a fixed-size stack buffer without length checking. The stack overflow overwrites the function return address with a pointer to the attacker's shellcode. When formNatlimit returns, execution jumps to the shellcode, giving the attacker root-level code execution on the router. From this position, the attacker can: (1) capture/intercept network traffic; (2) modify firewall rules; (3) install backdoors; (4) launch attacks on internal networks; (5) pivot to downstream devices. Public POC availability means this attack is reproducible and likely automated in exploit frameworks or bot scanning tools targeting exposed Tenda CH22 devices. Automated worms exploiting this vulnerability are a realistic concern given the ease of exploitation post-authentication.