EUVD-2025-17025
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability, which was classified as critical, was found in Tenda CH22 1.0.0.1. This affects the function formNatlimit of the file /goform/Natlimit. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical stack-based buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1, affecting the formNatlimit function in the /goform/Natlimit endpoint. An authenticated remote attacker can exploit improper input validation on the 'page' parameter to achieve arbitrary code execution with full system privileges (confidentiality, integrity, and availability compromise). Public exploit code is available and the vulnerability meets active exploitation criteria.
Technical Context
The vulnerability exists in a network routing device's web interface firmware. The affected endpoint /goform/Natlimit handles Network Address Translation (NAT) limit configuration. The formNatlimit function fails to properly validate the length of the 'page' input parameter before copying it to a stack-allocated buffer (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, a classic stack buffer overflow). CPE mapping: cpe:2.3:o:tenda:ch22_firmware:1.0.0.1:*:*:*:*:*:*:*. The stack-based nature of this overflow allows attackers to overwrite the return address and achieve code execution. This is characteristic of embedded router firmware vulnerabilities where input validation is often minimal and memory protections (ASLR, stack canaries) may be absent.
Affected Products
Tenda CH22 (['1.0.0.1'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today