CVE-2025-9812

7.4 highEPSS 0.7%

High (7.4) in tenda ch22 firmware. EPSS 0.7% chance of exploitation in the next 30 days.

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipulation of the argument cmdinput can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Severity

CVSS 4.0

7.4 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWEs: CWE-119, CWE-120
Published: 2025-09-02
Modified: 2026-09-26
Record from: the NVD, synced 2026-10-19

Affected

tenda:ch22_firmware

References

https://github.com/csgii/cve/issues/1
https://vuldb.com/?ctiid.322139
https://vuldb.com/?id.322139
https://vuldb.com/?submit.641148
https://www.tenda.com.cn/

Check your stack JSON