Cyber Posture

CVE-2025-12274

HighPublic PoC

Published: 27 October 2025

Published
27 October 2025
Modified
28 October 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0030 52.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-12274 is a buffer overflow vulnerability affecting Tenda CH22 firmware version 1.0.0.1. The issue resides in the fromP2pListFilter function within the /goform/P2pListFilter file, where manipulation of the "page" argument triggers the overflow. Associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L) and without requiring user interaction (UI:N). Successful exploitation allows high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) within the unchanged scope (S:U), potentially enabling arbitrary code execution or denial of service on the affected device.

Advisories and details are available via VulDB entries (ctiid.329946, id.329946, submit.674165) and a GitHub issue at QIU-DIE/CVE/issues/23, with the vendor site at tenda.com.cn listed as a reference. The exploit has been publicly disclosed and may be used, though no specific patch or mitigation steps are detailed in the available information.

Details

CWE(s)
CWE-119CWE-120

Affected Products

tenda
ch22 firmware
1.0.0.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Buffer overflow in web endpoint (/goform/P2pListFilter) enables remote exploitation of public-facing application for arbitrary code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References