CVE-2025-9748 is a high severity stack-based buffer overflow (CVSS 8.8) in the Tenda CH22 device, firmware 1.0.0.1. The ipsecno argument sent to /goform/IPSECsave in the httpd component can overflow a buffer. I could not confirm a fixed firmware, so limit access to the admin interface and check Tenda's advisories.
What's affected
The record lists Tenda CH22 version 1.0.0.1 as affected. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which describes a network attack with low complexity, but it needs a low privilege account and no user interaction.
Fixed versions: I could not confirm one. Check the Tenda support pages for your hardware revision before assuming a patched firmware exists.
How to check if you're exposed
Open the device status page and read the model and firmware version. The record lists CH22 firmware 1.0.0.1.
Check whether the management interface answers from outside your network. Only scan your own public address.
nmap -p 80,443,8080 YOUR_PUBLIC_IP
If the login page answers, remote administration is on and should be turned off unless you truly need it.
If you also build software for devices like this, the free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you track third party components and look up CVEs by id. They do not scan a router's installed firmware.
What to do now
- Turn off remote administration, and do not expose the device web interface to the internet.
- Restrict the admin interface to a trusted management address and keep the device on its own segment.
- Watch the vendor support page for your hardware revision, and apply firmware when a fixed build is published.
- Change the admin password and review settings for changes you did not make.
- Record the device in your asset list with an end of support date so it does not fade from view.
Why it matters
The weakness is CWE-119 (Memory Buffer Errors) and CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). The httpd service copies the ipsecno value into a fixed size buffer on the stack without checking its length. Writing past the end of that buffer can overwrite data the program relies on.
This is a memory safety flaw in the web management service of a network device, not an application bug. Fixes arrive as firmware, if they arrive at all.
The record gives the attack as remote, with a low privilege account required. Nothing in the record says the issue is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. The practical risk depends on whether the admin interface is reachable from untrusted networks.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does a stack buffer overflow always mean code execution?
No. At minimum it can crash the service. Whether it leads to code execution depends on the firmware and mitigations in place, which the record does not describe.
What is the quickest mitigation?
Restrict the admin interface to trusted addresses and keep it off the internet while you wait for a vendor firmware.
Sources
- Gold page for CVE-2025-9748
- NVD record data for CVE-2025-9748, as held in the Safeguard content batch
- Reporter write-up: https://github.com/physicszq/Routers/tree/main/tmp/02
Source note: the only advisory material I could read for this CVE is a public GitHub folder from the reporter, which I fetched. It is a researcher report, not a vendor advisory, and it does not name a fixed version.
Last reviewed: 18 October 2026.
