Which versions of Tenda are affected by CVE-2026-5154?

CVE-2026-5154 is a stack-based buffer overflow affecting Tenda CH22 routers (versions 1.0.0.1 and 1.1f) that allows authenticated attackers to execute arbitrary code.

Is there a public PoC exploit available for CVE-2026-5154?

Yes, a public proof-of-concept exploit is available for CVE-2026-5154. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5154?

Within 24 hours: Inventory all Tenda CH22 routers and document affected versions (1.0.0.1 and 1.1f); confirm current firmware versions through device management console. Within 7 days: Enforce strong authentication on all Tenda devices (minimum 16-character passwords, disable default credentials); restrict administrative access to trusted networks only via firewall rules. Within 30 days: Contact Tenda support for patch availability status and timeline; evaluate device replacement if no patch is released within 60 days; consider network segmentation to isolate router management interfaces from untrusted hosts.

Tenda CVE-2026-5154

Q: What is the CVSS score of CVE-2026-5154?

CVE-2026-5154 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17247 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-30 VulDB

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 01, 2026 - 14:24 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 23:00 euvd

EUVD-2026-17247

Analysis Generated

Mar 30, 2026 - 23:00 vuln.today

CVE Published

Mar 30, 2026 - 22:30 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability has been found in Tenda CH22 1.0.0.1/1.If. The impacted element is the function fromSetCfm of the file /goform/setcfm of the component Parameter Handler. The manipulation of the argument funcname leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda CH22 router (versions 1.0.0.1 and 1.If) allows authenticated remote attackers to achieve code execution via crafted 'funcname' parameter to the /goform/setcfm endpoint. Publicly available exploit code exists (GitHub POC), significantly lowering exploitation barrier. CVSS 7.4 with low attack complexity and authenticated remote vector indicates moderate risk for targeted attacks against devices with compromised credentials.

Technical ContextAI

This vulnerability affects the Tenda CH22 wireless router's web administration interface, specifically within the fromSetCfm function handler that processes HTTP requests to /goform/setcfm. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), occurring when the 'funcname' parameter is processed without adequate bounds checking. The affected component is the Parameter Handler module, which parses and validates user-supplied input from web interface requests. Stack-based buffer overflows occur when data written to a fixed-size stack buffer exceeds its allocated memory, potentially overwriting adjacent memory including return addresses and function pointers. In embedded router firmware like Tenda's, these handlers typically run with elevated privileges, making successful exploitation particularly severe. The CPE identifier cpe:2.3:a:tenda:ch22:*:*:*:*:*:*:*:* confirms this affects the CH22 product line across the specified firmware versions. The vulnerability exists in the core configuration management functionality that persists router settings.

RemediationAI

Users of affected Tenda CH22 routers should immediately check for firmware updates through the Tenda official website at https://www.tenda.com.cn/ or via the router's administration interface update mechanism. No vendor-released patch version is independently confirmed from the provided data sources at time of analysis. Until a patched firmware version is available and applied, implement the following risk mitigation controls: disable remote administration access to the router's web interface from WAN/internet-facing interfaces, restrict administrative access to trusted internal IP addresses only via firewall rules or access control lists, change default administrative credentials to strong unique passwords (minimum 16 characters with complexity), implement network segmentation to isolate the router's management interface from untrusted networks, and monitor authentication logs for suspicious login attempts to the /goform/ endpoints. Organizations should consider replacing affected devices with alternative models if Tenda does not release timely security updates. For detailed vulnerability technical analysis, consult the VulDB entry at https://vuldb.com/vuln/354186/cti and review the proof-of-concept code structure at the GitHub repository to understand attack patterns for detection rule development.