Is there a public PoC exploit available for CVE-2026-5153?

Yes, a public proof-of-concept exploit is available for CVE-2026-5153. Prioritise patching immediately. EPSS: 2.7%.

Tenda CVE-2026-5153

Q: What is the CVSS score of CVE-2026-5153?

CVE-2026-5153 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.7%.

EUVD-2026-17243 LOW

Command Injection (CWE-77)

2026-03-30 VulDB

GHSA-cg57-rmwp-qvm9

Command Injection Tenda

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 02, 2026 - 12:09 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 21:45 euvd

EUVD-2026-17243

Analysis Generated

Mar 30, 2026 - 21:45 vuln.today

CVE Published

Mar 30, 2026 - 21:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in Tenda CH22 1.0.0.1. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. Executing a manipulation of the argument mac can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used.

AnalysisAI

Command injection in Tenda CH22 1.0.0.1 via the FormWriteFacMac function allows authenticated remote attackers to execute arbitrary commands by manipulating the mac parameter in the /goform/WriteFacMac endpoint. Publicly available exploit code exists for this vulnerability, which carries a CVSS score of 6.3 and requires low-privilege authentication to trigger.

Technical ContextAI

The vulnerability exists in the web interface form handler of Tenda CH22, specifically the FormWriteFacMac function responsible for processing MAC address writes via the /goform/WriteFacMac endpoint. The underlying issue is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating that user-supplied input from the mac parameter is not adequately sanitized before being passed to command execution routines. The affected product is identified by CPE cpe:2.3:a:tenda:ch22:*:*:*:*:*:*:*:*, suggesting all versions of Tenda CH22 may be vulnerable. The web form processing logic fails to validate or escape shell metacharacters and command injection payloads, allowing an authenticated user to inject OS-level commands that execute in the context of the device's management service.

RemediationAI

Contact Tenda for security advisories and firmware updates addressing CVE-2026-5153. No vendor-released patch version is independently confirmed from available data at this time. As an interim mitigation, restrict network access to the CH22 web management interface (/goform/WriteFacMac endpoint) using firewall rules or network segmentation, limit administrative accounts to strong credentials, and disable remote management if not operationally required. Monitor device logs for suspicious command sequences in the mac parameter field. Refer to VulDB entry 354185 (https://vuldb.com/vuln/354185) for additional technical details and the publicly disclosed exploit code available at https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_60/README.md for vulnerability verification and remediation testing.