EUVD-2026-17243
GHSA-cg57-rmwp-qvm9
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates network-reachable attack surface with low complexity and low-privilege authentication requirement, resulting in confidentiality, integrity, and availability impact. The E:P flag denotes proof-of-concept code publication, and RC:R indicates reasonable confidence in the vulnerability. EPSS data is not provided, but the combination of public exploit availability, command injection capability enabling full system compromise, and low attack complexity creates a meaningful real-world risk despite the CVSS 6.3 score being in the medium range. The authentication requirement (PR:L) is a partial mitigating factor but does not eliminate risk, as many networked devices operate with default or easily-guessable credentials. This vulnerability merits prioritization for devices deployed in network-accessible environments where the administrator account may be compromised or poorly secured. |
| Exploit ScenarioDerived | An authenticated attacker with low-privilege access to the Tenda CH22 web interface crafts a malicious HTTP request to /goform/WriteFacMac with a command injection payload embedded in the mac parameter (e.g., mac=00:11:22:33:44:55;id;). The web form handler passes this unsanitized input directly to the OS command execution layer, allowing the attacker to execute arbitrary shell commands such as data exfiltration, configuration modification, or lateral movement within the network. Publicly available exploit code documented on GitHub enables rapid weaponization without requiring custom payload development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 30, 2026
Command injection in Tenda CH22 1.0.0.1 via the FormWriteFacMac function allows authenticated remote attackers to execute arbitrary commands by manipulating the mac parameter in the /goform/WriteFacMac endpoint. Publicly available exploit code exists for this vulnerability, which carries a CVSS score of 6.3 and requires low-privilege authentication to trigger.
RemediationAI
Contact Tenda for security advisories and firmware updates addressing CVE-2026-5153. No vendor-released patch version is independently confirmed from available data at this time. As an interim mitigation, restrict network access to the CH22 web management interface (/goform/WriteFacMac endpoint) using firewall rules or network segmentation, limit administrative accounts to strong credentials, and disable remote management if not operationally required. Monitor device logs for suspicious command sequences in the mac parameter field. Refer to VulDB entry 354185 (https://vuldb.com/vuln/354185) for additional technical details and the publicly disclosed exploit code available at https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_60/README.md for vulnerability verification and remediation testing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the web interface form handler of Tenda CH22, specifically the FormWriteFacMac function responsible for processing MAC address writes via the /goform/WriteFacMac endpoint. The underlying issue is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating that user-supplied input from the mac parameter is not adequately sanitized before being passed to command execution routines. The affected product is identified by CPE cpe:2.3:a:tenda:ch22:*:*:*:*:*:*:*:*, suggesting all versions of Tenda CH22 may be vulnerable. The web form processing logic fails to validate or escape shell metacharacters and command injection payloads, allowing an authenticated user to inject OS-level commands that execute in the context of the device's management service.
Know when Tenda gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in Tenda CH22 1.0.0.1. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. Executing a manipulation of the argument mac can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function. Rated high sev
Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attacke
The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers to bypass authentication
Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function. Rated critic
In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability
Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function via
Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function via
Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan. Rated critical severity (CV
Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet. Rated critical se
Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp. Rate
Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /
Certain Tenda products are vulnerable to command injection. Rated critical severity (CVSS 9.8), this vulnerability is re
Exploit-DB