CVE Alert: CVE-2025-12236 – Tenda – CH22

Risk verdict

High risk of remote code execution due to a buffer overflow in the DHCP list client, with a publicly disclosed exploit and a PoC available for use against exposed devices.

Why this matters

If an attacker realises code execution on an edge device, they can take full control, reconfigure networking, and pivot into adjacent hosts. The combination of remote access, high impact on confidentiality/integrity/availability, and a publicly known exploit makes this a pressing threat for environments with exposed management interfaces or LAN-facing services.

Most likely attack path

• No user interaction required; network-based exploitation is possible.
• Attacker needs only limited privileges on the target device and crafts a malicious input to the page parameter, triggering the overflow.
• Successful exploitation yields memory corruption and device compromise, enabling lateral movement within the protected network where the device acts as a gateway or central control point.

Who is most exposed

Consumer and small business routers with web-based management exposed to the internet or reachable via the LAN are most at risk, especially where WAN management is enabled or access controls are weak.

Detection ideas

• Unusual requests to the DHCP list client endpoint with anomalous page parameters.
• Repeated crashes or reboots logged on the device; memory corruption symptoms.
• Abnormal outbound/inbound traffic patterns around management interfaces.
• Core dumps or crash dumps tied to the affected component.
• Signature-based IOC alerts or CTI IOAs linked to this vulnerability.

Mitigation and prioritisation

• Apply vendor patch to the affected version as soon as available; verify deployment across all affected devices.
• If patching is delayed, disable or tightly restrict remote management interfaces; implement strict access controls and network segmentation.
• Block or monitor traffic to the vulnerable endpoint from untrusted networks; enforce least-privilege access to management services.
• Test fixes in a lab before roll-out; plan a staged, monitored deployment with rollback.
• If KEV/EPSS indicators are confirmed later, reclassify as higher priority accordingly.