Which versions of Tenda are affected by CVE-2026-5204?

CVE-2026-5204 is a high-severity stack-based buffer overflow in Tenda CH22 routers (version 1.0.0.1) that allows authenticated attackers to execute arbitrary code and fully compromise router…

Is there a public PoC exploit available for CVE-2026-5204?

Yes, a public proof-of-concept exploit is available for CVE-2026-5204. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5204?

Within 24 hours: Identify all Tenda CH22 v1.0.0.1 devices on your network using asset discovery tools and disable remote administrative access until mitigation is confirmed. Within 7 days: Contact Tenda for patch availability and timeline; consider replacement with patched hardware or alternative router models if no patch roadmap exists. Within 30 days: Implement network segmentation to isolate vulnerable routers, enforce strong authentication on any accessible administrative interfaces, and deploy intrusion detection rules to monitor for exploitation attempts targeting the formWebTypeLibrary function.

Tenda CVE-2026-5204

Q: What is the CVSS score of CVE-2026-5204?

CVE-2026-5204 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17509 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-31 VulDB

GHSA-5qj8-jcmc-3p6q

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 02, 2026 - 12:07 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 16:00 euvd

EUVD-2026-17509

Analysis Generated

Mar 31, 2026 - 16:00 vuln.today

CVE Published

Mar 31, 2026 - 15:45 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Articles & Coverage 1

vuln.today Threat Landscape 30/03-06/04/2026: Chrome Zero-Day, TrueConf Supply Chain, ShareFile Kill Chain Apr 06, 2026

AnalysisAI

Stack-based buffer overflow in Tenda CH22 router version 1.0.0.1 allows authenticated remote attackers to achieve arbitrary code execution via the webSiteId parameter in the formWebTypeLibrary function. Public exploit code exists on GitHub, significantly lowering the barrier to exploitation. While requiring low-privilege authentication (PR:L), the vulnerability enables complete compromise of router confidentiality, integrity, and availability with low attack complexity.

Technical ContextAI

This vulnerability affects the Tenda CH22 router firmware version 1.0.0.1, specifically within the Parameter Handler component that processes web interface requests. The formWebTypeLibrary function in /goform/webtypelibrary endpoint fails to properly validate input length for the webSiteId parameter before copying it to a fixed-size stack buffer. This is a classic CWE-121 stack-based buffer overflow, where attacker-controlled data exceeds allocated stack memory boundaries. Stack overflows are particularly dangerous in embedded devices like routers because they can overwrite return addresses and function pointers, enabling arbitrary code execution with the privileges of the web server process. The CPE identifier cpe:2.3:a:tenda:ch22:*:*:*:*:*:*:*:* confirms this affects the Tenda CH22 product line, though the specific vulnerable version is 1.0.0.1.

RemediationAI

No vendor-released patch has been identified in the available intelligence at time of analysis. Users should immediately check the Tenda support website at https://www.tenda.com.cn/ for firmware updates newer than version 1.0.0.1 and apply them if available. As interim mitigations, organizations should disable remote administration features to reduce network-based attack surface, change default administrative credentials to complex passwords unique to each device, implement network segmentation to isolate IoT devices including routers from critical systems, and restrict administrative interface access to trusted IP addresses only through firewall rules. Consider replacing affected devices with alternative router models if Tenda does not release a security update within a reasonable timeframe. Monitor the VulDB advisory at https://vuldb.com/vuln/354332 for updates on patch availability. For environments where these devices cannot be immediately replaced or patched, place them behind additional network security controls and monitor for suspicious authentication attempts or unusual outbound traffic patterns.