CVE-2025-14526CWE-119CWE-120

CVE-2025-14526

High · published December 11, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

⚡ A buffer overflow vulnerability in Tenda CH22 could let attackers remotely crash your router with a crafty tweak to an argument! 😱 Think of it like a waiter who takes a single order and, due to a miscommunication, accidentally spills an entire tray of food all over the floor. This flaw allows an attacker to trigger a malfunction that could bring down the whole system. If exploited, an attacker could potentially disrupt your network, causing outages or even allowing unauthorized access to your device. This is definitely no small hiccup; it could lead to a significant security breach, jeopardizing your sensitive information! 🔥

Put simply

Think of it like a waiter who takes a single order and, due to a miscommunication, accidentally spills an entire tray of food all over the floor. This flaw allows an attacker to trigger a malfunction that could bring down the whole system. The vulnerability exists in the function frmL7ImForm of the Tenda CH22 router, where manipulating the 'page' argument results in a buffer overflow, potentially allowing remote code execution. This means an attacker could exploit the flaw from afar without needing physical access.

What to do

If exploited, an attacker could potentially disrupt your network, causing outages or even allowing unauthorized access to your device. This is definitely no small hiccup; it could lead to a significant security breach, jeopardizing your sensitive information! 🔥 To protect your network, urgently patch to the latest firmware version provided by Tenda. Additionally, ensure your router's settings are configured to limit remote access and regularly check for updates to maintain security. 🛡️ You’ve got this! By taking these steps, you can keep your network safe and sound. Let's secure that router! 💪✨

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00759 · 54.8th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-12-11T22:15Z
Affected products (1)
ProductVersionsFixed in
tenda/ch22_firmwareall versions—
References (6)
EPSS history
Timeline
  • 11 DEC 16:32Z
    Tenda CH22 L7Im frmL7ImForm buffer overflow
    cvelistv5