CVE-2025-9812

HighCVSS 8.8/10Last modified Sep 26, 2026

Description

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipulation of the argument cmdinput can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-98138.8A vulnerability was identified in Tenda CH22 1.0.0.1. This issue affects the function formSetSambaConf of the file /goform/SetSambaConf. The CVE-2025-98149.8A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/c CVE-2025-98157.8A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file Privilege CVE-2025-98167.2The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2025-98177.5SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service CVE-2025-98186.7A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLU CVE-2025-98204.0A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. W CVE-2025-98212.7SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request CVE-2025-98225.5SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally ava CVE-2025-98234.8SummaryA Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s sessio CVE-2025-98245.9ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid u CVE-2025-98256.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that c