Ch22 CVE-2026-5604

Requires authenticated access to Tenda CH22 router running firmware version 1.0.0.1. Attacker must send crafted parameter to /goform/CertLocalPrecreate endpoint with manipulated 'standard' argument to trigger stack-based buffer overflow.

Real-world exploitation risk is elevated but requires authentication. The CVSS 4.0 score of 7.4 reflects high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H) with network attack vector (AV:N) and low complexity (AC:L), but requires low-level privileges (PR:L) indicating authentication is necessary. The Exploit maturity indicator (E:P) confirms proof-of-concept code exists, corroborated by the publicly available GitHub exploit. However, this is NOT in CISA's Known Exploited Vulnerabilities catalog, meaning no confirmed active exploitation in real-world attacks at time of analysis. The requirement for authentication (PR:L) significantly reduces the attack surface compared to unauthenticated vulnerabilities, as attackers must first obtain valid credentials to the router's administrative interface. That said, stack-based buffer overflows are reliably exploitable and can lead to complete device compromise including remote code execution with router-level privileges. The public exploit availability lowers the technical barrier for opportunistic attacks against devices with weak or default credentials. Priority should be moderate-to-high for environments using Tenda CH22 routers, particularly if exposed to untrusted networks or using default credentials, but this is not an immediate mass-exploitation scenario given the authentication prerequisite and absence of KEV listing.

An attacker on the internet identifies a Tenda CH22 router with exposed administrative interface (common on port 80/443). Using credential stuffing with default or commonly used passwords, the attacker authenticates to the web management panel. Leveraging the publicly available exploit code from GitHub, the attacker crafts a malicious HTTP request to /goform/CertLocalPrecreate with an oversized 'standard' parameter value designed to overflow the stack buffer. The overflow overwrites the return address on the stack, redirecting execution to attacker-controlled shellcode. The attacker gains complete control of the router with root-level privileges, enabling them to intercept traffic, modify DNS settings to redirect users to malicious sites, establish persistent backdoors, or pivot into the internal network behind the router.