CVE-2025-12274

HighCVSS 8.8/10Last modified Oct 8, 2026

Description

A security vulnerability has been detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument page leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
Tenda	CH22	1.0.0.1

References

https://github.com/QIU-DIE/CVE/issues/23Exploit, Issue Tracking
https://vuldb.com/?ctiid.329946Permissions Required, VDB Entry
https://vuldb.com/?id.329946Third Party Advisory, VDB Entry
https://vuldb.com/?submit.674165Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product
https://github.com/QIU-DIE/CVE/issues/23Exploit, Issue Tracking

Timeline

Published: Oct 27, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-122759.8Mail Configuration File Manipulation + Command Execution.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-122767.5A vulnerability was detected in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Affected by this issue is some unknown functional CVE-2025-122777.3A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883. This affects an unknown part of CVE-2025-122786.5Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-122794.8A vulnerability has been found in code-projects Client Details System 1.0. This vulnerability affects unknown code of the file /welcome.php.CVE-2025-12284.3A vulnerability classified as problematic has been found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6. Affected is an CVE-2025-122805.4A vulnerability was found in code-projects Client Details System 1.0. This issue affects some unknown processing of the file /update-clients CVE-2025-122815.4A vulnerability was determined in code-projects Client Details System 1.0. Impacted is an unknown function of the file /admin/clientview.php CVE-2025-122824.8A vulnerability was identified in code-projects Client Details System 1.0. The affected element is an unknown function of the file /admin/ma CVE-2025-122838.1A security flaw has been discovered in code-projects Client Details System 1.0. The impacted element is an unknown function. The manipulatio CVE-2025-122846.1Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.1 CVE-2025-122859.8Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.