Cyber Posture

CVE-2025-13288

HighPublic PoC

Published: 17 November 2025

Published
17 November 2025
Modified
19 November 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0030 52.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A security vulnerability has been detected in Tenda CH22 1.0.0.1. This impacts the function fromPptpUserSetting of the file /goform/PPTPUserSetting. The manipulation of the argument delno leads to buffer overflow. The attack is possible to be carried out remotely. The exploit…

more

has been disclosed publicly and may be used.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Validates inputs like the 'delno' argument in /goform/PPTPUserSetting to prevent buffer overflows from improper restriction of operations within memory bounds.

prevent

Implements memory safeguards such as ASLR, stack canaries, and DEP to protect against arbitrary code execution resulting from the buffer overflow.

preventrecover

Requires timely identification, reporting, and patching of the specific buffer overflow flaw in Tenda CH22 firmware version 1.0.0.1.

Security SummaryAI

CVE-2025-13288 is a buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1. The flaw affects the fromPptpUserSetting function in the /goform/PPTPUserSetting file, where manipulation of the "delno" argument triggers the overflow. It is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), with a CVSS v3.1 base score of 8.8.

The vulnerability enables remote exploitation by attackers with low privileges (PR:L), requiring network access (AV:N), low attack complexity (AC:L), and no user interaction (UI:N). Successful exploitation can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) within the unaugmented scope (S:U), potentially allowing arbitrary code execution or system compromise on the affected device.

Advisories and additional details are documented in references such as the GitHub issue at https://github.com/yyyy1g/CVE/issues/1, VulDB entries at https://vuldb.com/?ctiid.332628, https://vuldb.com/?id.332628, and https://vuldb.com/?submit.691594, and the vendor website at https://www.tenda.com.cn/. The exploit has been publicly disclosed and may be in use.

The vulnerability was published on 2025-11-17, highlighting the public availability of proof-of-concept exploits.

Details

CWE(s)

Affected Products

tenda
ch22 firmware
1.0.0.1

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Buffer overflow in the public-facing web interface (/goform/PPTPUserSetting) of Tenda CH22 router enables remote exploitation for initial access (T1190) or denial of service via application crash (T1499.004).

References