Sign-up

ID

VAR-202509-0136


CVE

CVE-2025-9812


TITLE

Shenzhen Tenda Technology Co.,Ltd.  of  ch22  Buffer error vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-014404

DESCRIPTION

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipulation of the argument cmdinput can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Shenzhen Tenda Technology Co.,Ltd. of ch22 The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability stems from the failure of the cmdinput parameter in the /goform/exeCommand file to properly validate the length of input data. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service

Trust: 2.16

sources: NVD: CVE-2025-9812 // JVNDB: JVNDB-2025-014404 // CNVD: CNVD-2025-21355

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-21355

AFFECTED PRODUCTS

vendor:tendamodel:ch22scope:eqversion:1.0.0.1

Trust: 1.6

vendor:tendamodel:ch22scope:eqversion:ch22 firmware 1.0.0.1

Trust: 0.8

vendor:tendamodel:ch22scope:eqversion: -

Trust: 0.8

vendor:tendamodel:ch22scope: - version: -

Trust: 0.8

sources: CNVD: CNVD-2025-21355 // JVNDB: JVNDB-2025-014404 // NVD: CVE-2025-9812

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-9812
value: HIGH

Trust: 1.0

OTHER: JVNDB-2025-014404
value: HIGH

Trust: 0.8

CNVD: CNVD-2025-21355
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2025-9812
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2025-014404
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2025-21355
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-9812
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

OTHER: JVNDB-2025-014404
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-21355 // JVNDB: JVNDB-2025-014404 // NVD: CVE-2025-9812

PROBLEMTYPE DATA

problemtype:CWE-120

Trust: 1.0

problemtype:CWE-119

Trust: 1.0

problemtype:Buffer error (CWE-119) [ others ]

Trust: 0.8

problemtype: Classic buffer overflow (CWE-120) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-014404 // NVD: CVE-2025-9812

EXTERNAL IDS

db:NVDid:CVE-2025-9812

Trust: 3.2

db:VULDBid:322139

Trust: 1.8

db:JVNDBid:JVNDB-2025-014404

Trust: 0.8

db:CNVDid:CNVD-2025-21355

Trust: 0.6

sources: CNVD: CNVD-2025-21355 // JVNDB: JVNDB-2025-014404 // NVD: CVE-2025-9812

REFERENCES

url:https://vuldb.com/?id.322139

Trust: 1.8

url:https://vuldb.com/?submit.641148

Trust: 1.8

url:https://www.tenda.com.cn/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2025-9812

Trust: 1.4

url:https://vuldb.com/?ctiid.322139

Trust: 1.0

url:https://github.com/csgii/cve/issues/1

Trust: 1.0

sources: CNVD: CNVD-2025-21355 // JVNDB: JVNDB-2025-014404 // NVD: CVE-2025-9812

SOURCES

db:CNVDid:CNVD-2025-21355
db:JVNDBid:JVNDB-2025-014404
db:NVDid:CVE-2025-9812

LAST UPDATE DATE

2025-09-26T23:38:17.860000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-21355date:2025-09-16T00:00:00
db:JVNDBid:JVNDB-2025-014404date:2025-09-24T09:09:00
db:NVDid:CVE-2025-9812date:2025-09-04T17:01:04.197

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-21355date:2025-09-16T00:00:00
db:JVNDBid:JVNDB-2025-014404date:2025-09-24T00:00:00
db:NVDid:CVE-2025-9812date:2025-09-02T03:15:43.153