CVE-2025-5685

🗓️ 05 Jun 2025 20:00:18Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 59 Views🌐 WEB

Critical vulnerability in Tenda CH22 remote stack-based overflow in formNatlimit function.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the formNatlimit() function in the microprogramming router software Tenda CH22 allows a hacker to execute arbitrary code.	9 Jun 202500:00	–	bdu_fstec
Circl	CVE-2025-5685	5 Jun 202521:04	–	circl
CNNVD	Tenda CH22 安全漏洞	5 Jun 202500:00	–	cnnvd
CNVD	Tenda CH22 Buffer Overflow Vulnerability	11 Jun 202500:00	–	cnvd
Cvelist	CVE-2025-5685 Tenda CH22 Natlimit formNatlimit stack-based overflow	5 Jun 202520:00	–	cvelist
EUVD	EUVD-2025-17025	3 Oct 202520:07	–	euvd
NVD	CVE-2025-5685	5 Jun 202520:15	–	nvd
OSV	CVE-2025-5685	5 Jun 202520:15	–	osv
Positive Technologies	PT-2025-23975 · Tenda · Tenda Ch22	4 Jun 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-5685	7 Jun 202520:00	–	redhatcve

NVD

Vulners

Node

tenda ch22_firmwareMatch1.0.0.1

AND

tenda ch22Match-

[
  {
    "vendor": "Tenda",
    "product": "CH22",
    "versions": [
      {
        "version": "1.0.0.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/xubeining/Cve_report/blob/main/A%20remote%20code%20execution%20vulnerability%20in%20the%20router%20CH22%20V1.0.0.1%20manufactured%20by%20Shenzhen%20Jixiangtengda%20Technology%20Co.%2C%20Ltd1.md
tenda	www.tenda.com.cn/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
page	request body	/goform/Natlimit	Stack-based buffer overflow via manipulated page argument in /goform/Natlimit (remote exploit).	CWE-119, CWE-787, CWE-121

17 Jun 2026 09:48Current

8.9High risk

Vulners AI Score8.9

CVSS 3.18.8 - 9.8

CVSS 48.7

CVSS 29

CVSS 38.8

EPSS0.00801

SSVC

tenda ch22 vulnerability critical security flaw remote attack stack-based overflow formnatlimit issue.