Which versions of Tenda are affected by CVE-2026-5155?

Tenda CH22 router version 1.0.0.1 contains a stack buffer overflow in the WAN configuration endpoint that allows authenticated users to execute arbitrary code or disable the device.

Is there a public PoC exploit available for CVE-2026-5155?

Yes, a public proof-of-concept exploit is available for CVE-2026-5155. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5155?

Within 24 hours: Inventory all Tenda CH22 routers (version 1.0.0.1) in production and document their network locations and current credentials. Within 7 days: Restrict administrative access to the affected routers via network segmentation or firewall rules limiting /goform/AdvSetWan endpoint access to trusted administrator IPs only; enforce strong, unique credentials on all devices. Within 30 days: Contact Tenda support for patch availability or hardware replacement timeline; evaluate migration to alternative router models with active security support, or prepare for device decommission if no patch is released.

Tenda CVE-2026-5155

Q: What is the CVSS score of CVE-2026-5155?

CVE-2026-5155 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17249 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-30 VulDB

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 02, 2026 - 12:08 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 23:00 euvd

EUVD-2026-17249

Analysis Generated

Mar 30, 2026 - 23:00 vuln.today

CVE Published

Mar 30, 2026 - 22:30 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function fromAdvSetWan of the file /goform/AdvSetWan of the component Parameter Handler. The manipulation of the argument wanmode results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

AnalysisAI

Stack-based buffer overflow in Tenda CH22 router (version 1.0.0.1) allows authenticated remote attackers to achieve code execution or denial of service via the wanmode parameter in the /goform/AdvSetWan endpoint. Public exploit code exists (GitHub POC), significantly lowering exploitation barriers. CVSS 7.4 reflects network-accessible attack requiring only low-privilege authentication, with high impact to confidentiality, integrity, and availability.

Technical ContextAI

This vulnerability affects the fromAdvSetWan function in the Parameter Handler component of Tenda CH22 router firmware version 1.0.0.1, specifically when processing HTTP requests to /goform/AdvSetWan. The root cause is CWE-121 (stack-based buffer overflow), where insufficient bounds checking on the wanmode parameter allows an attacker to write beyond allocated stack memory. Router web management interfaces commonly accept configuration parameters like WAN mode settings without proper validation, and stack overflows in embedded device firmware can lead to control flow hijacking due to overwriting return addresses or function pointers. The Tenda CH22 appears to be a consumer-grade wireless router where the administrative interface processes network configuration commands. CPE identifier cpe:2.3:a:tenda:ch22:*:*:*:*:*:*:*:* confirms this affects the application-level firmware of the CH22 product line.

RemediationAI

No vendor-released patch or updated firmware version has been independently confirmed from available data. Users should monitor Tenda's official support portal at https://www.tenda.com.cn/ for security updates and firmware releases addressing CVE-2026-5155. As interim mitigation, restrict access to the router's administrative interface: disable remote management features if enabled, ensure management interface is accessible only from trusted internal networks, change default administrative credentials to strong unique passwords, and implement network segmentation to prevent lateral movement if device is compromised. For environments with heightened security requirements where patching is unavailable, consider replacing affected devices with alternative router models that have received security updates. Technical details and proof-of-concept code are available at https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_47/README.md for validation and testing purposes in controlled environments.