Ch22 CVE-2026-5204

Requires authenticated access to Tenda CH22 1.0.0.1 router. Attacker must be logged into the device with user privileges to access the /goform/webtypelibrary endpoint and manipulate the webSiteId parameter to trigger stack-based buffer overflow.

This vulnerability presents significant real-world risk despite requiring authentication. The CVSS 4.0 score of 7.4 reflects high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H) with network-based attack vector (AV:N), low complexity (AC:L), and no user interaction required (UI:N). The authentication requirement (PR:L) provides minimal protection since many Tenda routers ship with default credentials that are widely documented and rarely changed by consumers. The public availability of exploit code (E:P confirmed, with GitHub repository at Litengzheng/vuldb_new) dramatically increases risk by enabling script-kiddie level attacks. No CISA KEV listing indicates this is not confirmed as actively exploited in significant campaigns at time of analysis, but the combination of default credential prevalence, public exploit, and router accessibility makes exploitation highly feasible. The CVSS vector shows no downstream impact to other systems (SC:N/SI:N/SA:N), limiting scope to the router itself, but complete router compromise enables network traffic interception, DNS hijacking, and lateral movement staging. This warrants immediate patching priority for organizations using affected devices.

An attacker on the internet scans for Tenda CH22 routers with exposed administrative interfaces, either on non-standard ports or through UPnP exposure. Finding a target running version 1.0.0.1, the attacker attempts authentication using common default credentials (admin/admin or variations documented in router databases). Upon successful authentication with low-privilege credentials, they craft a malicious HTTP POST request to /goform/webtypelibrary with an oversized webSiteId parameter containing shellcode. The formWebTypeLibrary function copies this input without bounds checking, overflowing the stack buffer and overwriting the return address. When the function returns, execution redirects to attacker-supplied shellcode, granting full control over the router. The attacker then installs persistent backdoor firmware, configures DNS hijacking to redirect banking sites to phishing servers, and uses the compromised router as a pivot point for attacking other devices on the victim's network. The publicly available exploit code on GitHub provides ready-made payload construction, making this scenario trivial to execute for even unsophisticated attackers.