CVE-2025-9007
Published: 15 August 2025
Summary
CVE-2025-9007 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ch22 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents the buffer overflow in /goform/editFileName by validating filename inputs for size and format restrictions.
Mitigates exploitation of the buffer overflow vulnerability through memory protections like non-executable memory and ASLR.
Requires timely patching or firmware upgrade for the known buffer overflow flaw in Tenda CH22 1.0.0.1.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web endpoint (/goform/editFileName) on network device firmware directly enables remote exploitation for RCE by authenticated attackers.
NVD Description
A vulnerability has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formeditFileName of the file /goform/editFileName. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the…
more
public and may be used.
Deeper analysisAI
CVE-2025-9007 is a buffer overflow vulnerability in Tenda CH22 firmware version 1.0.0.1, specifically affecting the formeditFileName function handled by the /goform/editFileName endpoint. Published on 2025-08-15, the issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
The vulnerability enables remote exploitation over the network by attackers possessing low privileges, such as authenticated users, with low attack complexity and no requirement for user interaction. Manipulation of the affected function triggers the buffer overflow, potentially allowing attackers to achieve high impacts on confidentiality, integrity, and availability, including arbitrary code execution.
Advisories and related details are available via VulDB entries (ctiid.320036, id.320036, submit.628867), a GitHub issue at github.com/moweizhang1994/cve/issues/3 disclosing the exploit, and the vendor site at tenda.com.cn. The exploit has been publicly disclosed and may be used by attackers.
Details
- CWE(s)