CVE-2025-12265
Tenda CH22 VirtualSer fromVirtualSer buffer overflow
- State
- Published
- Severity
- 8.7 High
- Published
- Oct 27, 2025
- Updated
- Feb 24, 2026
- Reserved
- Oct 26, 2025
Description
A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 8.8 High | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 9.0 High | AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
CH22Tenda |
|
References
- VDB-329936 | Tenda CH22 VirtualSer fromVirtualSer buffer overflowvdb-entrytechnical-description
- VDB-329936 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #674012 | Tenda CH22 V1.0.0.1 Buffer Overflowthird-party-advisory
- https://github.com/QIU-DIE/CVE/issues/18broken-linkexploitissue-tracking
- https://www.tenda.com.cn/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.