CVE-2025-11418
📋 TL;DR
This is a critical stack-based buffer overflow vulnerability in Tenda CH22 routers that allows remote attackers to execute arbitrary code or crash the device. The vulnerability exists in the HTTP request handler when processing specific parameters, and affects all versions up to 1.0.0.1. Attackers can exploit this without authentication to potentially take full control of affected routers.
💻 Affected Systems
- Tenda CH22
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistence installation, network traffic interception, and lateral movement to connected devices.
Likely Case
Device crash (DoS) or remote code execution allowing attacker to modify router settings, intercept traffic, or use the device as a botnet node.
If Mitigated
If properly segmented and monitored, impact limited to isolated network segment with potential for device compromise but limited lateral movement.
🎯 Exploit Status
Public exploit code is available, and the vulnerability requires no authentication, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for CH22. 3. Log into router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router after update completes.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Network segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected devices with supported models
- Implement strict network access controls to limit access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface. If version is 1.0.0.1 or earlier, device is vulnerable.Check Version:
Check via router web interface or SSH if available: cat /proc/version or show version commandsVerify Fix Applied:
Verify firmware version has been updated beyond 1.0.0.1 and test that the /goform/AdvSetWrlsafeset endpoint properly validates input.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/AdvSetWrlsafeset with unusual mit_ssid_index values
- Router crash/reboot logs
- Unusual process execution
Network Indicators:
- HTTP traffic to router on port 80/443 with POST to vulnerable endpoint
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (uri="/goform/AdvSetWrlsafeset" OR process="crash" OR event="reboot")