CVE-2025-9813

HighCVSS 8.8/10Last modified Sep 26, 2026

Description

A vulnerability was identified in Tenda CH22 1.0.0.1. This issue affects the function formSetSambaConf of the file /goform/SetSambaConf. The manipulation of the argument samba_userNameSda leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
Tenda	CH22	1.0.0.1

References

https://github.com/csgii/cve/issues/2Broken Link
https://vuldb.com/?ctiid.322140Permissions Required
https://vuldb.com/?id.322140Third Party Advisory, VDB Entry
https://vuldb.com/?submit.641151Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product

Timeline

Published: Sep 2, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-98149.8A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/c CVE-2025-98157.8A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file Privilege CVE-2025-98167.2The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2025-98177.5SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service CVE-2025-98186.7A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLU CVE-2025-98204.0A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. W CVE-2025-98212.7SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request CVE-2025-98225.5SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally ava CVE-2025-98234.8SummaryA Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s sessio CVE-2025-98245.9ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid u CVE-2025-98256.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that c CVE-2025-98265.4Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution f