Ch22 CVE-2026-5605

Requires authenticated access to Tenda CH22 router firmware 1.0.0.1. Attacker must send crafted HTTP request manipulating the 'GO' parameter to /goform/WrlExtraSet endpoint. Authentication credentials needed; unauthenticated remote exploitation not possible.

Real-world risk is HIGH despite requiring authentication (PR:L). The CVSS 8.8 score accurately reflects the severe impact potential: complete compromise of confidentiality, integrity, and availability on affected routers. CVSS vector shows network attack vector with low complexity and no user interaction required, meaning any attacker who gains low-privileged router credentials (often admin accounts with default/weak passwords on consumer devices) can exploit this remotely. Publicly available exploit code significantly amplifies risk by enabling script-kiddie level attacks and automated scanning campaigns. While not listed in CISA KEV (no confirmed active exploitation), the combination of remote exploitability, public POC, and the IoT/router attack surface makes this a realistic threat. SSVC framework indicators suggest elevated priority: exploitation status is POC-available, attack is potentially automatable given the straightforward HTTP-based trigger, and technical impact is total system compromise. Consumer routers rarely receive timely patches and often remain vulnerable indefinitely, creating persistent exposure. Organizations using Tenda CH22 devices should treat this as an immediate remediation priority.

An external attacker performs reconnaissance scanning to identify Tenda CH22 routers exposed on the internet or targets a specific organization known to use this model. Using credential stuffing, default password exploitation, or prior compromise, the attacker authenticates to the router's web administration interface with low-privileged credentials. The attacker then sends a crafted HTTP POST request to the /goform/WrlExtraSet endpoint with a maliciously oversized 'GO' parameter value designed to overflow the stack buffer and overwrite the return address with a pointer to attacker-controlled shellcode. Upon function return, execution redirects to the payload, granting the attacker root-level command execution on the router. From this position, the attacker can intercept network traffic, modify DNS settings for phishing attacks, pivot to internal network hosts, establish persistent backdoors, or enlist the device in a botnet. Publicly available exploit code at https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_54/README.md provides working proof-of-concept that threat actors can adapt for automated exploitation campaigns.