CVE Intelligence
Analysis AI-assisted

CVE-2025-11423: Tenda CH22 formSafeEmailFilter memory corruption

CVE-2025-11423 is a memory corruption flaw in the formSafeEmailFilter function of Tenda CH22 firmware 1.0.0.1, triggered by manipulating the page argument and reachable remotely. The record reports a CVSS 3.1 base score of 9.8 from the CNA VulDB and states that a public exploit exists. No fixed version is listed in the sources consulted, and the CVE is not in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-11423 describes a memory corruption issue in the formSafeEmailFilter function of Tenda CH22 version 1.0.0.1. The record was published on 2025-10-08 and assigned by the CNA VulDB. The weakness is classified as CWE-119, improper restriction of operations within the bounds of a memory buffer.

Impact

  • The record states that manipulating the page argument leads to memory corruption.
  • The record states the attack can be carried out remotely.
  • The VulDB vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scored 9.8, indicates network attack vector, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact.
  • SSVC data in the record rates technical impact as total and automatable as yes.

Affected products and versions

  • Tenda CH22, version 1.0.0.1.
  • Tenda CH22 Firmware, version 1.0.0.1.
  • The record does not list other affected versions. Whether other firmware builds are affected is unknown.

Exploitation status

The CVE is not listed in CISA KEV in the record, so no confirmed active exploitation is reported. The description states that the exploit has been made public and could be used, and the SSVC exploitation value is poc (proof of concept). The record also references a third-party issue tagged as exploit. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • The record lists no fixed version and no vendor patch. The absence of fix data is not evidence that no fix exists; the vendor status must be checked directly.
  • Identify every Tenda CH22 device and firmware 1.0.0.1 in the environment and confirm the vendor's current firmware.
  • Restrict access to the device management interface to trusted networks and remove direct exposure to the internet where possible.
  • Apply network segmentation and monitor the device until a verified update is installed.

Detection guidance

  • Review web server and management interface logs for unusual requests to the SafeEmailFilter handler and abnormal values in the page parameter.
  • Watch for device crashes, reboots or unexpected service restarts, which can accompany memory corruption.
  • Monitor for unexpected outbound connections from the device, which may indicate compromise.

Limitations of the available information

  • The record does not provide a vendor advisory, a patched version or a confirmed fix date.
  • The record does not confirm exploitation in the wild.
  • The EPSS entry in the record carries a date that should be verified before use in prioritization.
  • Affected hardware revisions and other firmware versions are not stated.

Frequently asked questions

Is CVE-2025-11423 being actively exploited?

The record does not list the CVE in CISA KEV, so no confirmed active exploitation is reported. A public exploit is stated to exist, and the SSVC exploitation value is poc, so the risk of exploitation should be treated seriously.

Which Tenda CH22 versions are affected?

The record lists Tenda CH22 and its firmware, version 1.0.0.1. Other versions are not stated in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.