Cyber Posture

CVE-2025-11418

CriticalPublic PoC

Published: 08 October 2025

Published
08 October 2025
Modified
09 October 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0087 75.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Security Summary

CVE-2025-11418 is a stack-based buffer overflow vulnerability affecting Tenda CH22 routers up to version 1.0.0.1. The issue resides in the formWrlsafeset function within the /goform/AdvSetWrlsafeset file of the HTTP Request Handler component, where manipulation of the mit_ssid_index argument triggers the overflow. It is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

The vulnerability enables remote exploitation by unauthenticated attackers without requiring user interaction or special privileges. Attackers can send crafted HTTP requests to the affected endpoint, leading to potential arbitrary code execution with high impacts on confidentiality, integrity, and availability.

Advisories referenced in VulDB entries (ctiid.327354, id.327354, submit.665615) and a GitHub issue (Sxxxw/cve/issues/2) document the vulnerability and public disclosure of an exploit, while the Tenda website (tenda.com.cn) provides general product information. No specific patches or mitigations are detailed in the available references. The exploit has been publicly disclosed and may be used.

Details

CWE(s)
CWE-119CWE-121

Affected Products

tenda
ch22 firmware
≤ 1.0.0.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Unauthenticated remote stack-based buffer overflow in the public-facing router's HTTP management endpoint (/goform/AdvSetWrlsafeset) enables exploitation for initial access (T1190), remote code execution (T1210), and denial of service via crash (T1499.004).

References