Cyber Posture

CVE-2025-13400

HighPublic PoC

Published: 19 November 2025

Published
19 November 2025
Modified
24 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0039 60.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was detected in Tenda CH22 1.0.0.1. Affected is the function formWrlExtraGet of the file /goform/WrlExtraGet. Performing a manipulation of the argument chkHz results in buffer overflow. Remote exploitation of the attack is possible. The exploit is now public…

more

and may be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the buffer overflow flaw in formWrlExtraGet by applying vendor firmware patches to eliminate the vulnerability.

SI-10 Information Input Validation good match
prevent

Enforces validation of the chkHz argument in the /goform/WrlExtraGet endpoint to prevent buffer overflows from manipulated inputs.

SI-16 Memory Protection good match
prevent

Provides memory protections like address space layout randomization and stack guards to block exploitation of the buffer overflow for arbitrary code execution.

Security SummaryAI

CVE-2025-13400 is a buffer overflow vulnerability (CWE-119, CWE-120) affecting Tenda CH22 router firmware version 1.0.0.1. The flaw resides in the formWrlExtraGet function within the /goform/WrlExtraGet endpoint, where manipulation of the chkHz argument triggers the overflow. Published on 2025-11-19, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), marking it as high severity.

Attackers with low privileges (PR:L) can exploit this remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing arbitrary code execution on the affected device.

Advisories from VULDB (https://vuldb.com/?ctiid.332926, https://vuldb.com/?id.332926, https://vuldb.com/?submit.692145) and the vendor site (https://www.tenda.com.cn/) provide further details, including a related GitHub issue with a public exploit (https://github.com/f000x0/cve/issues/14).

The exploit is now public and may be used, heightening the risk of real-world attacks against unpatched Tenda CH22 devices.

Details

CWE(s)
CWE-119CWE-120

Affected Products

tenda
ch22 firmware
1.0.0.1

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Unauthenticated buffer overflow in the router's public-facing web endpoint (/goform/WrlExtraGet) enables remote code execution via exploitation of a public-facing application (T1190) and denial of service through application crash or memory corruption (T1499.004).

References