CVE-2025-9443

A flaw has been found in Tenda CH22 1.0.0.1. This vulnerability affects the function formeditUserName of the file /goform/editUserName. Executing manipulation of the argument new_account can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
VulDBCNA
8.8 HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
VendorProductVersion
tendach22_firmware
1.0.0.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/moweizhang1994/cve/issues/4
https://vuldb.com/?ctiid.321281
https://vuldb.com/?id.321281
https://vuldb.com/?submit.634271
https://www.tenda.com.cn/
https://github.com/moweizhang1994/cve/issues/4