CVE-2025-13288
Published: 17 November 2025
Summary
CVE-2025-13288 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ch22 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates inputs like the 'delno' argument in /goform/PPTPUserSetting to prevent buffer overflows from improper restriction of operations within memory bounds.
Implements memory safeguards such as ASLR, stack canaries, and DEP to protect against arbitrary code execution resulting from the buffer overflow.
Requires timely identification, reporting, and patching of the specific buffer overflow flaw in Tenda CH22 firmware version 1.0.0.1.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the public-facing web interface (/goform/PPTPUserSetting) of Tenda CH22 router enables remote exploitation for initial access (T1190) or denial of service via application crash (T1499.004).
NVD Description
A security vulnerability has been detected in Tenda CH22 1.0.0.1. This impacts the function fromPptpUserSetting of the file /goform/PPTPUserSetting. The manipulation of the argument delno leads to buffer overflow. The attack is possible to be carried out remotely. The exploit…
more
has been disclosed publicly and may be used.
Deeper analysisAI
CVE-2025-13288 is a buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1. The flaw affects the fromPptpUserSetting function in the /goform/PPTPUserSetting file, where manipulation of the "delno" argument triggers the overflow. It is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), with a CVSS v3.1 base score of 8.8.
The vulnerability enables remote exploitation by attackers with low privileges (PR:L), requiring network access (AV:N), low attack complexity (AC:L), and no user interaction (UI:N). Successful exploitation can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) within the unaugmented scope (S:U), potentially allowing arbitrary code execution or system compromise on the affected device.
Advisories and additional details are documented in references such as the GitHub issue at https://github.com/yyyy1g/CVE/issues/1, VulDB entries at https://vuldb.com/?ctiid.332628, https://vuldb.com/?id.332628, and https://vuldb.com/?submit.691594, and the vendor website at https://www.tenda.com.cn/. The exploit has been publicly disclosed and may be in use.
The vulnerability was published on 2025-11-17, highlighting the public availability of proof-of-concept exploits.
Details
- CWE(s)