CVE-2025-9443
Published: 26 August 2025
Summary
CVE-2025-9443 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ch22 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Information Input Validation directly prevents buffer overflows by enforcing checks on the size and format of the new_account argument in the formeditUserName function.
Memory Protection implements safeguards like address space layout randomization and non-executable stacks to mitigate exploitation of the buffer overflow even if input validation fails.
Flaw Remediation requires timely identification, reporting, and patching of the buffer overflow vulnerability in the Tenda CH22 firmware.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web endpoint (/goform/editUserName) directly enables remote exploitation of a network device application for code execution.
NVD Description
A flaw has been found in Tenda CH22 1.0.0.1. This vulnerability affects the function formeditUserName of the file /goform/editUserName. Executing manipulation of the argument new_account can lead to buffer overflow. It is possible to launch the attack remotely. The exploit…
more
has been published and may be used.
Deeper analysisAI
CVE-2025-9443 is a buffer overflow vulnerability in Tenda CH22 firmware version 1.0.0.1, specifically affecting the formeditUserName function within the /goform/editUserName endpoint. By manipulating the new_account argument, attackers can trigger the overflow, as documented under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input). The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability enables remote exploitation over the network with low privileges (PR:L) and no user interaction required. An attacker with authenticated access, such as a low-level user account, can send a crafted request to the vulnerable endpoint, causing a buffer overflow that compromises confidentiality, integrity, and availability with high impact. This could allow arbitrary code execution, full system compromise, or denial of service on the affected device.
Advisories from VulDB (ctiid.321281, id.321281, submit.634271) detail the flaw and confirm remote exploitability, while a proof-of-concept exploit is publicly available in a GitHub repository (moweizhang1994/cve/issues/4). No vendor patches or specific mitigations are referenced in the provided sources, including the Tenda website.
The published exploit increases the risk of real-world attacks against exposed Tenda CH22 devices, particularly in home or small office networks.
Details
- CWE(s)