cbcvebase.
CVE-2025-14526
published 2025-12-11

CVE-2025-14526: A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a manipulation of the…

PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.71%
49.5th percentile
A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a manipulation of the argument page results in buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

Affected

2 ranges
VendorProductVersion rangeFixed in
tendach22——
tendach22_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/goform/L7Im↗
urlhttps://github.com/Eu21ka/cve_report
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda L7Im page Parameter Buffer Overflow Attempt (CVE-2025-14526)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:12; content:"/goform/L7Im"; fast_pattern; http.request_body; content:"page"; pcre:"/^\x3d[^\x26$]{100,}(?:\x26|$)/R"; reference:url,github.com/Eu21ka/cve_report; reference:cve,2025-14526; classtype:web-application-attack; sid:2062170; rev:2; metadata:affected_product Tenda, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_05_08, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_05_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Exploit targets HTTP POST requests to the exact URI /goform/L7Im (URI length is exactly 12 bytes); match on POST method and this URI path.
  • →The overflow is triggered via the 'page' parameter in the POST body; look for 'page=' followed by 100 or more characters (not '&') as the oversized payload pattern.
  • →The vulnerable function is frmL7ImForm in the file /goform/L7Im on Tenda CH22 1.0.0.1; exploitation is remote and a public exploit exists.
  • →Traffic is expected in plaintext (non-TLS); deploy detection at perimeter and internal network boundaries.
  • ·The Snort/Suricata rule (sid:2062170) targets only plaintext HTTP traffic; HTTPS-wrapped traffic to the device will not be detected by this signature.
  • ·The PCRE threshold of 100+ characters for the 'page' parameter value is the detection heuristic; legitimate traffic with a 'page' value of 100+ characters could produce false positives.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.