CVE-2025-12236
Published: 27 October 2025
Summary
CVE-2025-12236 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ch22 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents buffer overflow exploitation by validating the manipulated 'page' argument in the /goform/DhcpListClient CGI endpoint.
Requires identification, prioritization, and remediation of the buffer overflow flaw through firmware patching or updates.
Implements memory safeguards such as ASLR and DEP to mitigate arbitrary code execution from the buffer overflow even if input validation fails.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote buffer overflow in router web interface (/goform/DhcpListClient) enables public-facing application exploitation (T1190), remote service exploitation for code execution (T1210), and endpoint DoS via application crash (T1499.004).
NVD Description
A vulnerability was determined in Tenda CH22 1.0.0.1. This issue affects the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed…
more
and may be utilized.
Deeper analysisAI
CVE-2025-12236 is a buffer overflow vulnerability (CWE-119, CWE-120) affecting Tenda CH22 router firmware version 1.0.0.1. The flaw exists in the fromDhcpListClient function of the /goform/DhcpListClient CGI endpoint, where manipulation of the "page" argument triggers the overflow. Published on 2025-10-27 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), it enables remote exploitation.
Attackers with low privileges (PR:L) can exploit this over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation yields high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution or full device compromise. The exploit has been publicly disclosed and may be utilized by remote actors.
Advisories referenced in VulDB entries (ctiid.329906, id.329906) and submissions, along with a GitHub issue (QIU-DIE/CVE/issues/17), document the vulnerability but do not specify patches or mitigations in the available details. Security practitioners should monitor vendor updates for Tenda CH22 firmware remediation.
Details
- CWE(s)