CVE-2025-8180
Published: 26 July 2025
Summary
CVE-2025-8180 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ch22 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely identification, reporting, and correction of the buffer overflow flaw in the formdeleteUserName function of Tenda CH22 firmware version 1.0.0.1.
Requires validation of the old_account argument to block the buffer overflow manipulation in the /goform/deleteUserName endpoint.
Deploys memory protections such as stack canaries, ASLR, and DEP to thwart arbitrary code execution from the buffer overflow vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web management endpoint (/goform/deleteUserName) directly enables remote exploitation for code execution on a network device.
NVD Description
A vulnerability, which was classified as critical, has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formdeleteUserName of the file /goform/deleteUserName. The manipulation of the argument old_account leads to buffer overflow. The attack may be…
more
launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-8180 is a critical buffer overflow vulnerability (CWE-119, CWE-120) in Tenda CH22 router firmware version 1.0.0.1. The flaw affects the formdeleteUserName function in the /goform/deleteUserName endpoint, where manipulation of the old_account argument triggers the overflow. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-07-26.
A remote attacker with low privileges, such as an authenticated user, can exploit this vulnerability over the network with low attack complexity and no user interaction. Successful exploitation leads to high impacts on confidentiality, integrity, and availability, enabling potential arbitrary code execution via the buffer overflow.
Advisories from VulDB (ctiid.317594, id.317594, submit.621964) and a GitHub issue detail the vulnerability and public exploit disclosure. The Tenda vendor website provides general resources, but no specific patches or mitigations are outlined in the available references; practitioners should monitor for firmware updates.
Details
- CWE(s)