CVE-2025-12235

A vulnerability was found in Tenda CH22 1.0.0.1. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page results in buffer overflow. The attack must originate from the local network. The exploit has been made public and could be used.

CVSS 4.0

7.3CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.0CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

5.2% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-25)

CWEs

CWE-120, CWE-119

Published

2025-10-27

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Affected

• tenda:ch22_firmware

References

• https://github.com/QIU-DIE/CVE/issues/16
• https://vuldb.com/?ctiid.329905
• https://vuldb.com/?id.329905
• https://vuldb.com/?submit.673720
• https://www.tenda.com.cn/

Check your stackJSON