CVE-2025-11418: Tenda CH22 Stack-Based Buffer Overflow in HTTP Request Handler (formWrlsafeset)

Overview

CVE-2025-11418 affects the Tenda CH22 router firmware. According to the record, the HTTP Request Handler component, specifically the formWrlsafeset function, does not properly bound a memory write when processing a crafted parameter, which produces a stack-based buffer overflow (VulDB entry). The weakness is classified as CWE-119.

Impact

The CNA VulDB scores the issue at CVSS 3.1 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability, low complexity, no privileges and no user interaction, with high confidence, integrity and availability impact. The record's SSVC data lists technical impact as total and automatable as yes. Based on the vector, a successful attack could plausibly lead to a denial of service or code execution on the device, but the sources do not state the exact outcome.

Affected products and versions

• Tenda CH22, versions 1.0.0.0 and 1.0.0.1 as listed in the record.
• Tenda CH22 firmware, versions up to and including 1.0.0.1.

The record lists no fixed version. The absence of a fixed version in the record does not confirm that no fix exists; this must be verified with the vendor (Tenda).

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation can be stated from the sources consulted. The description states that the exploit has been publicly disclosed and may be used, and the SSVC exploitation value is poc (proof of concept). The EPSS probability is 0.0671 with a percentile of 0.93786 in the recorded data.

Remediation and mitigation

• Identify all Tenda CH22 devices and firmware builds in your environment and confirm the version against the affected range.
• Check the vendor site for a firmware update or an official advisory and apply it as soon as it is available (Tenda).
• Until a fix is verified, restrict access to the device web management interface to trusted administrative networks, and do not expose it to the internet.
• Replace unsupported or unpatched devices where a fix cannot be obtained.

Detection guidance

• Review web management access logs for unusual or unexpected requests to the router's HTTP management interface, especially from unknown sources.
• Monitor for device crashes, unexpected reboots or configuration changes, which may indicate abuse of a memory corruption flaw.
• Watch perimeter logs for inbound management traffic reaching the device from outside the local network.

Limitations of the available information

The sources consulted are the NVD and CVE Program records and the VulDB entries referenced in the record. The record does not provide vendor advisories, fixed versions, patch details, or confirmation of exploitation in the wild. The exact impact of exploitation, the required preconditions beyond the CVSS vector, and the status of vendor response are unknown.

Frequently asked questions

Is CVE-2025-11418 being actively exploited?

The record does not list it in the CISA KEV catalog, so no confirmed active exploitation can be stated from the sources consulted. The description says a public exploit has been disclosed and may be used.

Which Tenda CH22 versions are affected?

The record lists Tenda CH22 versions 1.0.0.0 and 1.0.0.1, and firmware up to and including 1.0.0.1. No fixed version is listed.

What should administrators do now?

Confirm the firmware version, check the vendor for an update, restrict access to the management interface to trusted networks, and monitor logs for unusual requests while waiting for a verified fix.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.