CVE-2025-12273
published 2025-10-27CVE-2025-12273: A weakness has been identified in Tenda CH22 1.0.0.1. Affected is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a…
PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.94%
56.9th percentile
A weakness has been identified in Tenda CH22 1.0.0.1. Affected is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a manipulation of the argument page can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tenda | ch22 | — | — |
| tenda | ch22_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attack uses HTTP POST method targeting the /goform/webExcptypemanFilter endpoint; detect POST requests with URI exactly 28 bytes matching this path.
- →The exploit sends the 'page' parameter (URL-encoded as 'page=') in the POST body with an oversized value of 100 or more characters before an ampersand or end-of-input, indicating a buffer overflow attempt.
- →Traffic is expected in plaintext (not TLS); deploy detection at the network perimeter and internally.
- →MITRE ATT&CK mapping: Initial Access (TA0001) via Exploit Public-Facing Application (T1190).
- ·Affected product is Tenda CH22 version 1.0.0.1 only; scope detection to this specific firmware version and device type.
- ·Public exploit code is available; treat any matching traffic as high-confidence active exploitation.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SPECIFIC_APPS Tenda webExcptypemanFilter page Parameter Buffer Overflow Attempt (CVE-2025-12273)
suricata·2025-10-27·CVSS 7.4
CVE-2025-12273 [HIGH] ET WEB_SPECIFIC_APPS Tenda webExcptypemanFilter page Parameter Buffer Overflow Attempt (CVE-2025-12273)
ET WEB_SPECIFIC_APPS Tenda webExcptypemanFilter page Parameter Buffer Overflow Attempt (CVE-2025-12273)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda webExcptypemanFilter page Parameter Buffer Overflow Attempt (CVE-2025-12273)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:28; content:"/goform/webExcptypemanFilter"; fast_pattern; http.request_body; content:"page|3d|"; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:url,github.com/QIU-DIE/CVE/issues/22; reference:cve,2025-12273; classtype:web-application-attack; sid:2065414; rev:1; metadata:affected_product Tenda, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_10_27, cve CVE_2025_12273, deployment Perimeter, deployment Internal, performance_impact Low, confidence Hi
No public exploits indexed.
No writeups or analysis indexed.
2025-10-27
Published