CVE-2025-11418
Published: 08 October 2025
Summary
CVE-2025-11418 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ch22 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the stack-based buffer overflow vulnerability by requiring timely patching of the affected Tenda CH22 firmware up to version 1.0.0.1.
Prevents remote exploitation by enforcing validation of the mit_ssid_index argument in HTTP requests to the formWrlsafeset function, avoiding buffer overflows.
Mitigates stack-based buffer overflow impacts through memory protection mechanisms such as stack canaries, address space layout randomization, and non-executable stacks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote stack-based buffer overflow in the public-facing router's HTTP management endpoint (/goform/AdvSetWrlsafeset) enables exploitation for initial access (T1190), remote code execution (T1210), and denial of service via crash (T1499.004).
NVD Description
A security vulnerability has been detected in Tenda CH22 up to 1.0.0.1. This issue affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of the component HTTP Request Handler. The manipulation of the argument mit_ssid_index leads to stack-based buffer overflow. The…
more
attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Deeper analysisAI
CVE-2025-11418 is a stack-based buffer overflow vulnerability affecting Tenda CH22 routers up to version 1.0.0.1. The issue resides in the formWrlsafeset function within the /goform/AdvSetWrlsafeset file of the HTTP Request Handler component, where manipulation of the mit_ssid_index argument triggers the overflow. It is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation by unauthenticated attackers without requiring user interaction or special privileges. Attackers can send crafted HTTP requests to the affected endpoint, leading to potential arbitrary code execution with high impacts on confidentiality, integrity, and availability.
Advisories referenced in VulDB entries (ctiid.327354, id.327354, submit.665615) and a GitHub issue (Sxxxw/cve/issues/2) document the vulnerability and public disclosure of an exploit, while the Tenda website (tenda.com.cn) provides general product information. No specific patches or mitigations are detailed in the available references. The exploit has been publicly disclosed and may be used.
Details
- CWE(s)