Cyber Posture

CVE-2025-12236

HighPublic PoC

Published: 27 October 2025

Published
27 October 2025
Modified
24 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0041 61.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Security Summary

CVE-2025-12236 is a buffer overflow vulnerability (CWE-119, CWE-120) affecting Tenda CH22 router firmware version 1.0.0.1. The flaw exists in the fromDhcpListClient function of the /goform/DhcpListClient CGI endpoint, where manipulation of the "page" argument triggers the overflow. Published on 2025-10-27 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), it enables remote exploitation.

Attackers with low privileges (PR:L) can exploit this over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation yields high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution or full device compromise. The exploit has been publicly disclosed and may be utilized by remote actors.

Advisories referenced in VulDB entries (ctiid.329906, id.329906) and submissions, along with a GitHub issue (QIU-DIE/CVE/issues/17), document the vulnerability but do not specify patches or mitigations in the available details. Security practitioners should monitor vendor updates for Tenda CH22 firmware remediation.

Details

CWE(s)
CWE-119CWE-120

Affected Products

tenda
ch22 firmware
1.0.0.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Unauthenticated remote buffer overflow in router web interface (/goform/DhcpListClient) enables public-facing application exploitation (T1190), remote service exploitation for code execution (T1210), and endpoint DoS via application crash (T1499.004).

References