Tenda CVE-2026-5155

Requires authenticated access to Tenda CH22 1.0.0.1 router web interface. Attacker must send crafted HTTP request with malicious wanmode parameter to /goform/AdvSetWan endpoint to trigger stack-based buffer overflow in Parameter Handler. No victim interaction needed.

Real-world risk is elevated despite requiring authentication (PR:L). The CVSS 4.0 vector shows network attack vector (AV:N), low attack complexity (AC:L), no attack requirements (AT:N), and high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H). The E:P (Proof-of-concept) metric confirms public exploit availability, corroborated by the GitHub POC reference. While EPSS data is not provided, publicly available exploit code for network-accessible router vulnerabilities typically results in elevated exploitation probability. No CISA KEV status is indicated, suggesting no confirmed active exploitation at time of analysis. However, router vulnerabilities with public exploits often see scanning activity within days of disclosure. SSVC considerations: exploitation status is POC-level, attack is automatable given network exposure and low complexity, and technical impact is high (potential full device compromise). Primary risk mitigation is that exploitation requires valid credentials, but default/weak passwords on consumer routers remain common. This should be prioritized for devices with internet-facing management interfaces or untrusted authenticated users.

An attacker who has obtained low-privilege credentials to the Tenda CH22 router (such as through credential stuffing, default passwords, or phishing) connects to the web management interface over the network. The attacker crafts an HTTP POST request to /goform/AdvSetWan with an oversized wanmode parameter value designed to overflow the stack buffer. By carefully controlling the overflow data, the attacker overwrites the return address on the stack to redirect execution to injected shellcode or existing gadgets in firmware memory (return-oriented programming). Successful exploitation grants the attacker arbitrary code execution with the privileges of the web server process, typically root on embedded devices, allowing installation of persistent backdoors, traffic interception, or use of the compromised router as a pivot point for attacks against internal network hosts. Public exploit code availability means attackers can automate this attack against internet-exposed Tenda CH22 devices with minimal technical expertise.