CVE-2025-12265: A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation…

PriorityP262critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.96%

58.0th percentile

A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
tenda	ch22	—	—
tenda	ch22_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/goform/VirtualSer

urlhttps://github.com/QIU-DIE/CVE/issues/18

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda VirtualSer page Parameter Buffer Overflow Attempt (CVE-2025-12265)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:18; content:"/goform/VirtualSer"; fast_pattern; http.request_body; content:"page|3d|"; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:url,github.com/QIU-DIE/CVE/issues/18; reference:cve,2025-12265; classtype:web-application-attack; sid:2065416; rev:1; metadata:affected_product Tenda, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_10_27, cve CVE_2025_12265, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_10_27, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

→Exploit traffic is HTTP POST only — filter on POST method to /goform/VirtualSer to reduce false positives.
→The overflow is triggered via the `page` parameter in the POST body; look for `page=` (hex: `page|3d|`) followed by a value of 100 or more characters before an `&` or end-of-body.
→The URI path has an exact byte size of 18 (`/goform/VirtualSer`); a `bsize:18` match on the URI is a high-confidence indicator of targeting this specific endpoint.
→Traffic is plaintext HTTP (tls_state: plaintext); TLS-based inspection is not required for detection.
→The vulnerable function is `fromVirtualSer` in the file `/goform/VirtualSer` on Tenda CH22 firmware version 1.0.0.1; scope detection to that firmware version. ↗

·The Snort/Suricata rule (SID 2065416) is scoped to `$HOME_NET` as the destination — ensure `$HOME_NET` includes the IP ranges of any Tenda CH22 devices in the environment, otherwise the rule will not fire.
·The PCRE threshold of 100 characters for the `page` parameter value (`[^&]{100,}`) is the detection trigger; legitimate `page` values shorter than 100 characters will not match, meaning only clearly oversized payloads are flagged.
·The exploit is publicly available; treat any match as high-severity and prioritise immediate triage. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.