Cyber Posture

CVE-2025-12271

HighPublic PoC

Published: 27 October 2025

Published
27 October 2025
Modified
28 October 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0043 62.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Security Summary

CVE-2025-12271 is a buffer overflow vulnerability (CWE-119, CWE-120) in Tenda CH22 firmware version 1.0.0.1. The flaw affects the fromRouteStatic function in the /goform/RouteStatic file, where manipulation of the "page" argument triggers the overflow. Published on 2025-10-27, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An attacker with low privileges can exploit this remotely over the network with low complexity and no user interaction. Successful exploitation grants high-impact access, enabling full compromise of confidentiality, integrity, and availability on the affected device.

Advisories and references include VulDB entries (ctiid.329943, id.329943, submit.674153) detailing the issue, a GitHub repository (QIU-DIE/CVE/issues/20) with a publicly available exploit, and the Tenda website (tenda.com.cn). No specific patches or mitigations are detailed in the provided information.

Details

CWE(s)
CWE-119CWE-120

Affected Products

tenda
ch22 firmware
1.0.0.1

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Unauthenticated remote buffer overflow in router's web interface (/goform/RouteStatic) enables DoS via application exploitation (T1499.004), initial access by exploiting public-facing application (T1190), and RCE for privilege escalation (T1068).

References