Which versions of Tenda CH22 are affected by CVE-2026-19346?

Tenda CH22 router firmware version 1.0.0.1 contains a command injection vulnerability allowing any authenticated user-including those with low-privilege accounts-to execute arbitrary system commands,…

How to fix or mitigate CVE-2026-19346?

Within 24 hours, inventory all Tenda CH22 devices in your environment and document their deployment context and network accessibility. Within 7 days, restrict network access to the /goform/CertListInfo endpoint via firewall rules, disable remote management interfaces if not operationally required, and apply principle of least privilege to accounts with device administration access. Within 30 days, establish a vendor communication plan to track firmware updates, evaluate device replacement with alternatives from vendors with active security support, and implement network segmentation to isolate any remaining affected devices from sensitive systems.

Tenda CH22 CVE-2026-19346

Q: What is the CVSS score of CVE-2026-19346?

CVE-2026-19346 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.2%.

EUVD-2026-54915 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-08-09 cna@vuldb.com

GHSA-cfh9-rj2q-vjwm

Command Injection Tenda

7.4

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-accessible CGI endpoint requires only low-privilege authentication; unsanitized input yields full OS command execution with high C/I/A impact and no scope change to external systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 09, 2026 - 10:31 vuln.today

CVE Published

Aug 09, 2026 - 10:17 cve.org

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Command injection in Tenda CH22 firmware version 1.0.0.1 allows a low-privilege authenticated remote attacker to execute arbitrary OS-level commands by supplying a malicious Name parameter to the formCertListInfo function at the /goform/CertListInfo endpoint. The vulnerability carries a CVSS 4.0 score of 7.4 with high impact across confidentiality, integrity, and availability of the affected device. A public proof-of-concept has been disclosed via a VulDB submission and associated Notion writeup, materially lowering the exploitation bar; no vendor-released patch has been identified at time of analysis.

Technical ContextAI

The Tenda CH22 is a consumer-grade SOHO wireless router running embedded Linux firmware at version 1.0.0.1. The vulnerable code path resides in the formCertListInfo handler, exposed via the /goform/CertListInfo CGI endpoint - a pattern pervasive across Tenda router product lines where web form handlers invoke system() or popen()-style calls with unsanitized user-supplied input. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) identifies the root cause: the Name argument is incorporated into a downstream shell invocation without proper sanitization or escaping of shell metacharacters such as semicolons, backticks, or pipes. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N confirms the endpoint is directly network-accessible, exploitable at low complexity with no attack requirements, and demands only low-privilege credentials. The /goform/ CGI endpoint family is a historically well-targeted attack surface on Tenda and comparable embedded device firmware, with numerous prior CVEs following the same injection pattern in adjacent handlers.

RemediationAI

No vendor-released patch has been identified at time of analysis - monitor https://www.tenda.com.cn/ for firmware updates addressing this CVE. As the primary compensating control, restrict access to the device's web management interface by placing it on an isolated management VLAN and explicitly blocking external WAN-side access to all /goform/ endpoints; this eliminates remote network exposure but does not protect against authenticated LAN-side attackers. Replace any default credentials immediately to remove the low-privilege authentication step as a trivially bypassed barrier - note this reduces but does not eliminate risk if other credential theft vectors exist. If the device firmware supports disabling certificate management functionality, disabling the feature invoking formCertListInfo removes the vulnerable handler from the attack surface at the cost of losing that administrative capability. Monitor outbound traffic from the device for anomalous connections as a post-exploitation indicator. The public PoC writeup at https://candle-throne-f75.notion.site/Tenda-CH22-formCertListInfo-387df0aa118580b4abfcffaf2fceb9ff should be reviewed to understand the exact injection syntax and inform firewall rule specificity.