CVE-2025-11117 Overview
CVE-2025-11117 is a buffer overflow vulnerability affecting the Tenda CH22 router running firmware version 1.0.0.1. The flaw resides in the formWrlExtraGet function within /goform/GstDhcpSetSer, where the dips argument is processed without proper bounds checking. Remote attackers with low privileges can trigger memory corruption over the network. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed devices. The vulnerability is tracked under CWE-119 for improper restriction of operations within the bounds of a memory buffer.
Critical Impact
Successful exploitation can lead to memory corruption, denial of service, and potential remote code execution on affected Tenda CH22 routers.
Affected Products
- Tenda CH22 router (hardware)
- Tenda CH22 firmware version 1.0.0.1
- Deployments exposing the /goform/GstDhcpSetSer endpoint to untrusted networks
Discovery Timeline
- 2025-09-28 - CVE-2025-11117 published to NVD
- 2025-10-03 - Last updated in NVD database
Technical Details for CVE-2025-11117
Vulnerability Analysis
The vulnerability exists in the formWrlExtraGet handler exposed through the /goform/GstDhcpSetSer web endpoint of the Tenda CH22 router. The handler copies attacker-controlled data from the dips HTTP parameter into a fixed-size memory buffer without validating the input length. An authenticated remote attacker can send a crafted HTTP request that overflows the destination buffer. Memory corruption of this nature on MIPS or ARM-based embedded routers typically results in process crash, configuration tampering, or arbitrary code execution depending on stack layout and protections.
Details of the issue are referenced in the GitHub CVE Issue Discussion and the VulDB Entry #326198.
Root Cause
The root cause is the absence of length validation when copying the dips parameter into a stack or heap buffer inside formWrlExtraGet. The function trusts attacker-supplied input from the HTTP request body, classified under [CWE-119] as improper restriction of operations within the bounds of a memory buffer. Embedded HTTP daemons in consumer router firmware frequently lack stack canaries, ASLR, and non-executable memory, which amplifies the consequences of bounds violations.
Attack Vector
The attack is delivered over the network against the router's HTTP management interface. The attacker submits a POST request to /goform/GstDhcpSetSer with an oversized dips value. Exploitation requires low privileges, meaning a valid management session or default credentials are needed. The public disclosure of the exploit details lowers the barrier to weaponization.
No verified proof-of-concept code is published in the references. See the VulDB CTI Entry #326198 for additional context on exploitation patterns.
Detection Methods for CVE-2025-11117
Indicators of Compromise
- HTTP POST requests to /goform/GstDhcpSetSer containing unusually long dips parameter values
- Unexpected reboots, crashes, or restarts of the httpd process on the Tenda CH22 router
- Unauthorized configuration changes to DHCP or wireless settings on the device
- Outbound connections from the router to untrusted IP addresses following management-interface access
Detection Strategies
- Inspect web server and gateway logs for POST requests targeting /goform/GstDhcpSetSer with parameter lengths exceeding normal client behavior
- Deploy IDS/IPS signatures that flag oversized parameter values in HTTP requests to Tenda goform endpoints
- Monitor router syslog output for repeated daemon crashes or watchdog-initiated reboots
Monitoring Recommendations
- Centralize router syslog and management-plane access logs for correlation with broader network telemetry
- Alert on management-interface access from non-administrative network segments or external IP ranges
- Track firmware versions across the fleet and flag devices still running 1.0.0.1
How to Mitigate CVE-2025-11117
Immediate Actions Required
- Restrict access to the router's web management interface to trusted internal management VLANs only
- Disable remote WAN-side management on all Tenda CH22 devices
- Rotate administrative credentials and remove any default or shared accounts
- Inventory all Tenda CH22 devices running firmware 1.0.0.1 and prioritize them for remediation
Patch Information
At the time of NVD publication, no vendor advisory or patched firmware has been listed in the references. Check the Tenda Official Website for firmware updates addressing CVE-2025-11117 and apply them as soon as they become available.
Workarounds
- Place affected routers behind a firewall that blocks inbound HTTP/HTTPS access from untrusted networks
- Segment management traffic onto a dedicated VLAN with strict ACLs limiting which hosts can reach /goform/ endpoints
- Consider replacing end-of-support consumer routers with devices that receive timely security updates if no firmware fix is released
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
