Tenda CH22 L7Im frmL7ImForm buffer overflow

published 2025-12-11 10 mo ago modified 2026-10-07 32 d ago also EUVD-2025-202766

cvss: 8.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits: 0; none known

A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a manipulation of the argument page results in buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 10 mo ago (2025-12-15)

Exploit prediction

0.76% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/maximdevere/CVE2/issues/5#issue-3673676260 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/maximdevere/CVE2/issues/5 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CNA	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CNA	2.0	9.0	AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
CNA	4.0	7.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA	2.0	9.0	AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected products

Tenda CH22

Classification

Weakness

CWE-120 Buffer Copy without Checking Size of Input
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

github.com /maximdevere/CVE2/issues/5#issue-3673676260
exploit, issue-tracking, third-party-advisory
github.com /maximdevere/CVE2/issues/5
issue-tracking, exploit, third-party-advisory
vuldb.com /?id.335866
vdb-entry, technical-description, third-party-advisory
vuldb.com /?ctiid.335866
signature, permissions-required, vdb-entry
vuldb.com /?submit.703035
third-party-advisory, vdb-entry
tenda.com.cn /
product

Sources

CVE List CVE-2025-14526
NVD CVE-2025-14526

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary