Sign-up

ID

VAR-202508-2273


CVE

CVE-2025-9443


TITLE

Shenzhen Tenda Technology Co.,Ltd.  of  ch22  Buffer error vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-012797

DESCRIPTION

A flaw has been found in Tenda CH22 1.0.0.1. This vulnerability affects the function formeditUserName of the file /goform/editUserName. Executing manipulation of the argument new_account can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used. Shenzhen Tenda Technology Co.,Ltd. of ch22 The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2025-9443 // JVNDB: JVNDB-2025-012797

AFFECTED PRODUCTS

vendor:tendamodel:ch22scope:eqversion:1.0.0.1

Trust: 1.0

vendor:tendamodel:ch22scope: - version: -

Trust: 0.8

vendor:tendamodel:ch22scope:eqversion: -

Trust: 0.8

vendor:tendamodel:ch22scope:eqversion:ch22 firmware 1.0.0.1

Trust: 0.8

sources: JVNDB: JVNDB-2025-012797 // NVD: CVE-2025-9443

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-9443
value: HIGH

Trust: 1.0

OTHER: JVNDB-2025-012797
value: HIGH

Trust: 0.8

cna@vuldb.com: CVE-2025-9443
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2025-012797
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

cna@vuldb.com: CVE-2025-9443
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

OTHER: JVNDB-2025-012797
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2025-012797 // NVD: CVE-2025-9443

PROBLEMTYPE DATA

problemtype:CWE-120

Trust: 1.0

problemtype:CWE-119

Trust: 1.0

problemtype:Buffer error (CWE-119) [ others ]

Trust: 0.8

problemtype: Classic buffer overflow (CWE-120) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-012797 // NVD: CVE-2025-9443

EXTERNAL IDS

db:NVDid:CVE-2025-9443

Trust: 2.6

db:VULDBid:321281

Trust: 1.8

db:JVNDBid:JVNDB-2025-012797

Trust: 0.8

sources: JVNDB: JVNDB-2025-012797 // NVD: CVE-2025-9443

REFERENCES

url:https://github.com/moweizhang1994/cve/issues/4

Trust: 1.8

url:https://vuldb.com/?id.321281

Trust: 1.8

url:https://vuldb.com/?submit.634271

Trust: 1.8

url:https://www.tenda.com.cn/

Trust: 1.8

url:https://vuldb.com/?ctiid.321281

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2025-9443

Trust: 0.8

sources: JVNDB: JVNDB-2025-012797 // NVD: CVE-2025-9443

SOURCES

db:JVNDBid:JVNDB-2025-012797
db:NVDid:CVE-2025-9443

LAST UPDATE DATE

2025-09-06T00:10:38.605000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2025-012797date:2025-09-03T07:22:00
db:NVDid:CVE-2025-9443date:2025-09-02T18:13:49.087

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2025-012797date:2025-09-03T00:00:00
db:NVDid:CVE-2025-9443date:2025-08-26T03:15:31.573