Cyber Posture

CVE-2025-12233

HighPublic PoC

Published: 27 October 2025

Published
27 October 2025
Modified
24 February 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0039 60.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-12233 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ch22 Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents buffer overflow by validating the manipulated 'page' argument in the /goform/SafeUrlFilter endpoint.

prevent

Implements memory protections like stack canaries and non-executable memory to block exploitation of the buffer overflow vulnerability.

prevent

Requires timely remediation of the identified buffer overflow flaw in Tenda CH22 firmware version 1.0.0.1 via patching.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Unauthenticated remote buffer overflow in the router's web management interface (/goform/SafeUrlFilter) enables exploitation of public-facing applications (T1190), remote services (T1210), and application/system crashes for DoS (T1499.004), potentially leading to arbitrary code execution and information disclosure.

NVD Description

A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a manipulation of the argument page can lead to buffer overflow. The attack can be launched remotely. The…

more

exploit has been published and may be used.

Deeper analysisAI

CVE-2025-12233 is a buffer overflow vulnerability affecting Tenda CH22 firmware version 1.0.0.1, published on 2025-10-27. The flaw resides in the fromSafeUrlFilter function within the /goform/SafeUrlFilter file, where manipulation of the "page" argument triggers the overflow. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWEs-119 and CWE-120.

A remote attacker with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, such as arbitrary code execution or denial of service. An exploit has been publicly disclosed and may be actively used.

Advisories and additional details are documented in references including a GitHub issue at https://github.com/QIU-DIE/CVE/issues/14, VulDB entries at https://vuldb.com/?ctiid.329903, https://vuldb.com/?id.329903, and https://vuldb.com/?submit.673714, as well as the vendor site at https://www.tenda.com.cn/. No specific patch or mitigation guidance is detailed in the CVE description.

Details

CWE(s)

Affected Products

tenda
ch22 firmware
1.0.0.1

CVEs Like This One

CVE-2025-12236Same product: Tenda Ch22
CVE-2025-11117Same product: Tenda Ch22
CVE-2025-12273Same product: Tenda Ch22
CVE-2025-13288Same product: Tenda Ch22
CVE-2025-12272Same product: Tenda Ch22
CVE-2025-12234Same product: Tenda Ch22
CVE-2025-13400Same product: Tenda Ch22
CVE-2025-12271Same product: Tenda Ch22
CVE-2025-11418Same product: Tenda Ch22
CVE-2025-12232Same product: Tenda Ch22

References