CVE-2025-11117
📋 TL;DR
A buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1 allows remote attackers to execute arbitrary code or cause denial of service by sending specially crafted requests to the /goform/GstDhcpSetSer endpoint. This affects all users running the vulnerable firmware version on Tenda CH22 routers.
💻 Affected Systems
- Tenda CH22
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete router compromise, credential theft, network traffic interception, and lateral movement to connected devices.
Likely Case
Router crash/reboot causing denial of service, potentially allowing attackers to gain initial access to the network.
If Mitigated
Limited impact if network segmentation prevents lateral movement and router is isolated from critical systems.
🎯 Exploit Status
Public exploit details available on GitHub. The vulnerability requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for CH22
3. Access router admin interface
4. Navigate to firmware upgrade section
5. Upload and apply new firmware
6. Reboot router
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Access router admin panel -> System -> Remote Management -> Disable
Network segmentation
allIsolate router management interface from user networks
🧯 If You Can't Patch
- Replace affected routers with different models or brands
- Implement strict firewall rules to block access to router management interface from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 1.0.0.1, the device is vulnerable.Check Version:
Access router web interface and check System Status or Firmware Information pageVerify Fix Applied:
Verify firmware version has been updated to a version later than 1.0.0.1📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/GstDhcpSetSer with unusual parameter lengths
- Router crash/reboot events in system logs
Network Indicators:
- HTTP POST requests to router IP on port 80/443 targeting /goform/GstDhcpSetSer with large dips parameter
SIEM Query:
source="router_logs" AND (url="/goform/GstDhcpSetSer" OR message="buffer overflow" OR message="crash")