EUVD-2026-43301
GHSA-mg6v-gcmc-mw8w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable low-complexity endpoint needing low-privilege web-UI auth (PR:L), no user interaction, with full device compromise giving high C/I/A.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in Tenda CH22 1.0.0.1. This impacts the function formCertListInfo of the file /goform/CertListInfo. The manipulation of the argument Name results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
AnalysisAI
Buffer overflow in the Tenda CH22 router (firmware 1.0.0.1) allows a remote, authenticated attacker to corrupt memory by supplying an overlong 'Name' argument to the formCertListInfo function in the /goform/CertListInfo endpoint. The flaw was disclosed by VulDB with publicly available exploit code, and the CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact. No public exploit identified in CISA KEV, so this is a proof-of-concept-stage issue rather than confirmed in-the-wild abuse.
Technical ContextAI
The Tenda CH22 is a SOHO/consumer wireless router whose web management interface is served by a 'goform' CGI-style handler. The vulnerable routine formCertListInfo processes the /goform/CertListInfo request and copies the attacker-controlled 'Name' parameter into a fixed-size stack or global buffer without bounds checking. This maps to CWE-120 (Buffer Copy without Checking Size of Input, the classic 'Classic Buffer Overflow'), a memory-safety defect endemic to embedded MIPS/ARM firmware written in C where user input is handled with unsafe copy primitives like strcpy/sprintf. The single affected product per CPE data is cpe:2.3:a:tenda:ch22 across firmware 1.0.0.1.
RemediationAI
No vendor-released patch identified at time of analysis; no fixed firmware version is cited in the input data, so contact Tenda (https://www.tenda.com.cn/) for updated CH22 firmware and monitor for a release addressing the /goform/CertListInfo handler. As compensating controls, restrict access to the router's web management interface to trusted LAN hosts only and disable any remote/WAN-side administration so the /goform endpoint is unreachable from the internet - this blocks the network attack vector at the cost of remote manageability. Enforce strong, unique administrative credentials and rotate any default passwords, since exploitation requires low-privilege authentication (PR:L); this raises the bar for an attacker who would otherwise reach the endpoint with a weak session. Where feasible, place the device behind a firewall segment and log/alert on requests to /goform/CertListInfo. Reference the disclosure at https://vuldb.com/vuln/377893 for tracking.
Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to execu
Stack-based buffer overflow in Tenda CH22 router version 1.0.0.1 allows authenticated remote attackers to achieve arbitr
Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to achie
Command injection in Tenda CH22 version 1.0.0.1 allows a remote low-privileged attacker to execute arbitrary OS commands
Command injection in Tenda CH22 firmware 1.0.0.1 allows low-privileged remote attackers to execute arbitrary OS commands
Command injection in Tenda CH22 firmware version 1.0.0.1 allows a low-privileged remote attacker to execute arbitrary OS
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today