Which versions of Tenda are affected by CVE-2026-5152?

Tenda CH22 router version 1.0.0.1 contains a stack-based buffer overflow in the file creation endpoint that allows authenticated users with low-privilege access to execute arbitrary code remotely.

Is there a public PoC exploit available for CVE-2026-5152?

Yes, a public proof-of-concept exploit is available for CVE-2026-5152. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5152?

Within 24 hours: Inventory all Tenda CH22 routers running version 1.0.0.1 and restrict network access to the /goform/createFileName endpoint using firewall rules or access control lists. Within 7 days: Contact Tenda for patch status and timeline; if unavailable, evaluate replacement with alternative router models from vendors with active security support. Within 30 days: Complete migration away from affected CH22 devices or implement compensating network segmentation controls if replacement is unavailable.

Tenda CVE-2026-5152

Q: What is the CVSS score of CVE-2026-5152?

CVE-2026-5152 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17218 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-30 VulDB

GHSA-w9hr-c3cr-g2ww

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 02, 2026 - 12:10 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 21:00 euvd

EUVD-2026-17218

Analysis Generated

Mar 30, 2026 - 21:00 vuln.today

CVE Published

Mar 30, 2026 - 20:30 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was detected in Tenda CH22 1.0.0.1. Impacted is the function formCreateFileName of the file /goform/createFileName. Performing a manipulation of the argument fileNameMit results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda CH22 router version 1.0.0.1 allows authenticated remote attackers to achieve arbitrary code execution via the formCreateFileName function. The vulnerability resides in the /goform/createFileName endpoint where insufficient input validation of the 'fileNameMit' parameter enables memory corruption. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation. While requiring low-privilege authentication (PR:L), the attack complexity is low (AC:L) and can be executed remotely over the network.

Technical ContextAI

This vulnerability affects the Tenda CH22 router firmware (CPE: cpe:2.3:a:tenda:ch22:*:*:*:*:*:*:*:*), specifically version 1.0.0.1. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), a memory corruption issue where unchecked input exceeds allocated buffer boundaries on the stack. The formCreateFileName function in the /goform/createFileName endpoint fails to properly validate the length of the 'fileNameMit' parameter before copying it into a fixed-size stack buffer. This classic buffer overflow condition allows attackers to overwrite adjacent memory, including return addresses and function pointers, enabling control flow hijacking. Consumer-grade routers like the Tenda CH22 frequently run embedded Linux systems with limited memory protection mechanisms (no ASLR, stack canaries, or DEP), making stack-based overflows particularly dangerous in these environments. The /goform/ directory typically hosts the router's web management interface CGI handlers.

RemediationAI

No vendor-released patch identified at time of analysis. The provided Tenda vendor reference (https://www.tenda.com.cn/) does not link to a specific firmware update or security bulletin addressing CVE-2026-5152. Users should immediately check the Tenda support portal for firmware updates newer than version 1.0.0.1 and apply them if available. As interim mitigations: (1) disable remote management access to the web interface to limit attack surface to LAN-only, (2) change default administrative credentials to strong unique passwords to raise the authentication barrier, (3) implement network segmentation to isolate the router management interface from untrusted networks, (4) monitor authentication logs for suspicious login attempts to /goform/ endpoints. For enterprise environments, consider replacing affected devices with enterprise-grade networking equipment that receives regular security updates. Review VulDB entries at https://vuldb.com/vuln/354184 and https://vuldb.com/vuln/354184/cti for ongoing intelligence updates. Given the availability of public exploit code (https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_50/README.md), treatment as a high-priority vulnerability is warranted even without confirmed active exploitation.