CVE-2025-12273 is a high buffer overflow in the Tenda CH22, firmware 1.0.0.1. The fromwebExcptypemanFilter function handles the page argument at /goform/webExcptypemanFilter without a sufficient length check. NVD scores it 8.8. I could not confirm a fixed firmware, so restrict admin access and check the vendor.
What's affected
The NVD record names the Tenda CH22 running firmware 1.0.0.1. The vulnerable function is fromwebExcptypemanFilter in /goform/webExcptypemanFilter, and the manipulated argument is page. The handler name points to a web filter configuration page. The record gives no more detail on what the page does.
The CVSS vector is network based and needs a low privilege account, so the attacker has to be logged in, or hold some access to the web interface. It rates impact as high for confidentiality, integrity and availability. The record says the exploit has been made public.
On fixes: the record names none, and I could not confirm a fixed firmware from the pages I could read. Check the vendor's download page for your model and compare any newer firmware to 1.0.0.1.
How to check if you're exposed
- Identify your CH22 units. Check your asset list, and look for the model name on the device label or the admin page.
- Read the firmware version in the admin interface. A match with 1.0.0.1 means the unit is in scope.
- Find out whether the admin interface is reachable from the internet. A quick check from outside your network is to look at the public address of the site and see if the admin port answers, or to run
nmap -p 80,443,8080 203.0.113.5with your own public address in place of that example, from a machine outside the network. - Check who has a login on the device. The attack needs low privileges, so every shared or default password makes the risk larger.
What to do now
- Turn off remote administration from the internet on the CH22. Manage it from the LAN or a VPN only.
- Change the admin password to a unique, long one, and delete any accounts you do not use.
- Look for newer firmware on the vendor's site, and upgrade if the release notes mention the issue or a fix for overflow bugs. The record lists no fixed version, so treat vendor notes as the source of truth.
- Segment the device from sensitive networks, and keep guests and IoT gear on a separate network.
- If the vendor does not release a fix and the device protects something that matters, plan to replace it with one whose vendor responds to security reports.
Why it matters
The record lists CWE-119, improper restriction of operations within the bounds of a memory buffer, and CWE-120, classic buffer overflow. A web handler copies a value from the request into a fixed size buffer without checking how long it is. If the value is too long, the copy writes past the end of the buffer and corrupts adjacent memory. On an embedded device, that can mean a crash or, in the worst case, code running on the device.
Embedded web servers are a repeat source of this bug. They are written in C, they parse many form fields by hand, and they often run with the highest privileges on the box. The fix is a bounds check or a bounded copy, and it is usually a small change that the vendor has to ship.
The record does not mark this CVE as exploited and it is not in the CISA Known Exploited Vulnerabilities catalog. Public exploit details do exist, so assume that automated scanners will add it.
Quick check
Do I need a login to use CVE-2025-12273?
The CVSS vector lists a low privilege requirement, so yes, some access to the interface is needed. Shared or weak admin passwords reduce that barrier a lot.
Is there a firmware fix?
I could not confirm one. Check the vendor's download page for your model, and do not rely on remote administration being safe in the meantime.
Sources
Last reviewed: 19 October 2026.
