CVE-2025-12233

Опубликовано: 27 окт. 2025

Источник: nvd

CVSS3: 8.8

CVSS2: 9

EPSS Низкий

Описание

A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing manipulation of the argument page can lead to buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.

Ссылки

https://github.com/QIU-DIE/CVE/issues/14
Exploit
Third Party Advisory
https://vuldb.com/?ctiid.329903
Permissions Required
VDB Entry
https://vuldb.com/?id.329903
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.673714
Third Party Advisory
VDB Entry
https://www.tenda.com.cn/
Product
https://github.com/QIU-DIE/CVE/issues/14
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:tenda:ch22_firmware:1.0.0.1:*:*:*:*:*:*:*

cpe:2.3:h:tenda:ch22:*:*:*:*:*:*:*:*

EPSS

Процентиль: 35%

0.00146

Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-119

CWE-120

Связанные уязвимости

GHSA-7c4j-cf3j-qjcm

CVSS3: 8.8

github

3 месяца назад

BDU:2025-13859

CVSS3: 9.8

fstec

4 месяца назад

Уязвимость функции fromSafeUrlFilter() (/goform/SafeUrlFilter) микропрограммного обеспечения маршрутизаторов Tenda CH22, позволяющая нарушителю выполнить произвольный код