CVE-2025-11117
Published: 28 September 2025
Summary
CVE-2025-11117 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ch22 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring timely identification, reporting, and patching of the buffer overflow flaw in the formWrlExtraGet function.
Prevents exploitation of the buffer overflow by enforcing input validation on the 'dips' argument at web form entry points.
Mitigates successful buffer overflow exploitation by implementing memory protections to block unauthorized code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote buffer overflow in router web interface (/goform/GstDhcpSetSer) via 'dips' parameter enables exploitation of public-facing application (T1190), exploitation of remote service potentially for code execution (T1210), and application crash for endpoint DoS (T1499.004).
NVD Description
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formWrlExtraGet of the file /goform/GstDhcpSetSer. This manipulation of the argument dips causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been…
more
publicly disclosed and may be utilized.
Deeper analysisAI
CVE-2025-11117 is a buffer overflow vulnerability in Tenda CH22 firmware version 1.0.0.1. The flaw affects the formWrlExtraGet function in the /goform/GstDhcpSetSer file, where manipulation of the "dips" argument triggers the overflow. Associated with CWE-119 and CWE-120, it was published on 2025-09-28 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability is remotely exploitable over the network with low attack complexity and requires only low privileges from the attacker, with no user interaction needed. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially enabling arbitrary code execution or full device compromise.
Advisories referenced in VulDB entries (ctiid.326198, id.326198, submit.662927) and a GitHub issue (zhaoyinshan/CVE/issues/2) describe the issue and note that an exploit has been publicly disclosed and may be utilized. The vendor's site (tenda.com.cn) is listed among references, though specific patch details are not outlined in available information.
The public disclosure of the exploit code elevates the risk for unpatched Tenda CH22 devices exposed to the internet.
Details
- CWE(s)