CVE-2025-12232
Published: 27 October 2025
Summary
CVE-2025-12232 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ch22 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-12232 is a buffer overflow vulnerability in Tenda CH22 firmware version 1.0.0.1. The flaw affects the fromSafeClientFilter function in the /goform/SafeClientFilter file, where manipulation of the "page" argument triggers the overflow. Published on 2025-10-27, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
The vulnerability enables remote exploitation over the network with low complexity and requires only low privileges, such as an authenticated user account, but no user interaction. Attackers can achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution or device compromise.
Advisories provide additional details via VulDB entries (ctiid.329902, id.329902, submit.673713) and a GitHub issue at QIU-DIE/CVE/issues/13, with the vendor site at www.tenda.com.cn/. An exploit is publicly available and may be actively used.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-36105
Vulnerability details
A vulnerability was detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manipulation of the argument page results in buffer overflow. The attack can be initiated remotely. The exploit is…
more
now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated buffer overflow in /goform/SafeClientFilter enables remote arbitrary code execution or denial of service on the public-facing router web interface.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents buffer overflow by validating and sanitizing the 'page' argument in the fromSafeClientFilter function to ensure inputs stay within memory bounds.
Implements runtime memory protections like stack canaries, ASLR, and non-executable memory to block exploitation of the buffer overflow vulnerability.
Mandates timely remediation of the known buffer overflow flaw in Tenda CH22 firmware version 1.0.0.1 via patching or upgrades.