CVE-2025-11423
Published: 08 October 2025
Summary
CVE-2025-11423 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ch22 Firmware. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-11423 is a memory corruption vulnerability (CWE-119) affecting Tenda CH22 firmware version 1.0.0.1. The issue resides in the formSafeEmailFilter function within the /goform/SafeEmailFilter endpoint, where manipulation of the "page" argument triggers the corruption. Published on 2025-10-08, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with no requirements for authentication or user interaction.
The vulnerability enables remote exploitation without privileges, allowing unauthenticated attackers to send crafted requests to the affected endpoint. Successful exploitation results in high-impact compromise of confidentiality, integrity, and availability, potentially leading to full device control via memory corruption. A public exploit is available, increasing the risk of widespread abuse against exposed Tenda CH22 devices.
Advisories and details are documented in references including a GitHub issue at https://github.com/f000x0/cve/issues/7 and VulDB entries at https://vuldb.com/?ctiid.327358, https://vuldb.com/?id.327358, and https://vuldb.com/?submit.666009, with the vendor site at https://www.tenda.com.cn/. No specific patch or mitigation details are outlined in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31854
Vulnerability details
A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function formSafeEmailFilter of the file /goform/SafeEmailFilter. Performing a manipulation of the argument page results in memory corruption. The attack is possible to be carried out remotely. The exploit has…
more
been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated buffer overflow in public-facing router web interface (/goform/SafeEmailFilter) enables remote exploitation for memory corruption, facilitating arbitrary code execution (T1190) or application crash/DoS (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the memory corruption flaw in the Tenda CH22 firmware, directly eliminating the vulnerability.
Mandates validation of the 'page' argument in the /goform/SafeEmailFilter endpoint to block malformed inputs that trigger memory corruption.
Implements memory safeguards like ASLR and DEP to protect against exploitation of the memory corruption vulnerability even if inputs are malformed.