Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-13400: Tenda CH22 Device May Allow Remote Attackers to Take Control

CVE-2025-13400 · published 11 months ago

Summary

A security issue was found in the Tenda CH22 device's software. If an attacker can exploit this vulnerability, they might be able to take control of the device. We recommend updating the device to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
tenda	ch22_firmware	1.0.0.1 `cpe:2.3:o:tenda:ch22_firmware:1.0.0.1:::::::*`

Original advisory text

A vulnerability was detected in Tenda CH22 1.0.0.1. Affected is the function formWrlExtraGet of the file /goform/WrlExtraGet. Performing a manipulation of the argument chkHz results in buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used.

References

https://github.com/f000x0/cve/issues/14 Exploit Issue Tracking Third Party Advisory
https://vuldb.com/?ctiid.332926 Permissions Required VDB Entry
https://vuldb.com/?id.332926 Third Party Advisory VDB Entry
https://vuldb.com/?submit.692145 Third Party Advisory VDB Entry
https://www.tenda.com.cn/ Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-119Buffer Overflow

CWE-120Classic Buffer Overflow

Timeline

Published19 Nov 2025

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2025-13400 · NVD

Track software like this

Free during beta