CVE-2025-15229

MEDIUM

Tenda Ch22 Firmware < 1.0.0.1 - Improper Resource Release

Title source: rule

Description

A vulnerability has been found in Tenda CH22 up to 1.0.0.1. Affected by this vulnerability is the function fromDhcpListClient of the file /goform/DhcpListClient. Such manipulation of the argument LISTLEN leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

References (5)

[Third Party Advisory, VDB Entry] https://vuldb.com/?id.338625

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.338625

[Third Party Advisory, VDB Entry] https://vuldb.com/?submit.725472

[Exploit, Issue Tracking, Third Party Advisory] https://github.com/master-abc/cve/issues/7

[Product] https://www.tenda.com.cn/

Scores

CVSS v3 5.3

EPSS 0.0043

EPSS Percentile 62.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-404

Status published

Products (1)

tenda/ch22_firmware < 1.0.0.1

Published Dec 30, 2025

Tracked Since Feb 18, 2026