Vulnerability · Published Oct 8, 2025 · Assigned by VulDB
CVE-2025-11423Tenda CH22 SafeEmailFilter formSafeEmailFilter memory corruption
Critical 9.8
In plain English
A critical-severity memory corruption in CH22 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.9%top 41.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function formSafeEmailFilter of the file /goform/SafeEmailFilter. Performing a manipulation of the argument page results in memory corruption. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Affected products (as reported)
Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-327358 | Tenda CH22 SafeEmailFilter formSafeEmailFilter memory corruption vdb-entry, technical-description
- VDB-327358 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #666009 | Tenda Shenzhen Jixiang Tengda Technology Co., Ltd. Router CH22 V1.0.0.1 Tenda V1.0.0.1 Buffer Overflow third-party-advisory
- https://github.com/f000x0/cve/issues/7 exploit, issue-tracking
- https://www.tenda.com.cn/ product