Executive Summary

CVE-2025-11117 is a critical buffer overflow vulnerability in the Tenda CH22 router version 1.0.0.1. It occurs in the function formWrlExtraGet within the file /goform/GstDhcpSetSer, where the dips argument is improperly handled. Specifically, the input buffer is copied into a fixed-size output buffer without verifying the input size, causing a buffer overflow. This flaw can be exploited remotely without authentication by sending a specially crafted HTTP POST request, potentially leading to device crashes or further exploitation. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to remotely crash your Tenda CH22 router, causing a denial of service and making the device unresponsive. Because the buffer overflow affects confidentiality, integrity, and availability, it could also potentially be exploited for further attacks beyond denial of service. The attack complexity is low, and exploits are publicly available, meaning your device is at significant risk if unpatched. [1, 2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for HTTP POST requests sent to the endpoint /goform/GstDhcpSetSer with an unusually large or malformed 'dips' parameter. A practical detection method is to capture and inspect network traffic for such requests. For example, using tcpdump or Wireshark to filter HTTP POST requests to the vulnerable endpoint. A sample tcpdump command could be: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/goform/GstDhcpSetSer'. Additionally, you can use curl or similar tools to test the endpoint by sending crafted POST requests with oversized 'dips' parameters to see if the device responds abnormally or crashes. For example: curl -X POST http://<router-ip>/goform/GstDhcpSetSer -d 'dips=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include replacing the affected Tenda CH22 router version 1.0.0.1 with a non-vulnerable device, as no known countermeasures or patches currently exist. Additionally, restricting remote access to the router's management interface, such as blocking external HTTP POST requests to /goform/GstDhcpSetSer, can reduce exposure. Network-level protections like firewall rules or intrusion prevention systems can be configured to detect and block suspicious requests targeting this endpoint. Monitoring the device for crashes or unresponsiveness can also help identify exploitation attempts. [1]

Useful 0 Not Useful 0