Which versions of Ch22 are affected by CVE-2026-5605?

Tenda CH22 router firmware version 1.0.0.1 contains a stack-based buffer overflow vulnerability (CVSS 8.8) that allows authenticated attackers to execute arbitrary code on affected devices.

Is there a public PoC exploit available for CVE-2026-5605?

Yes, a public proof-of-concept exploit is available for CVE-2026-5605. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5605?

Within 24 hours: Identify all Tenda CH22 devices running firmware 1.0.0.1 in your environment and document their network locations and connected services. Within 7 days: Restrict network access to the /goform/WrlExtraSet endpoint using firewall rules, disable remote administration capabilities on affected devices, and change all default/weak administrative credentials. Within 30 days: Contact Tenda for patch availability and timeline; if no patch is released, evaluate replacement with patched router models or disable affected devices until vendor remediation is available.

Ch22 CVE-2026-5605

Q: What is the CVSS score of CVE-2026-5605?

CVE-2026-5605 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19140 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-05 VulDB

Tenda Buffer Overflow Stack Overflow Ch22

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 23:30 euvd

EUVD-2026-19140

Analysis Generated

Apr 05, 2026 - 23:30 vuln.today

CVE Published

Apr 05, 2026 - 23:15 nvd

HIGH 7.4

DescriptionCVE.org

A weakness has been identified in Tenda CH22 1.0.0.1. This affects the function formWrlExtraSet of the file /goform/WrlExtraSet. Executing a manipulation of the argument GO can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to achieve arbitrary code execution via the formWrlExtraSet function. The vulnerability resides in the /goform/WrlExtraSet endpoint where manipulation of the 'GO' parameter triggers memory corruption. With CVSS 8.8 (network-accessible, low complexity, requires low-privileged authentication), this represents a critical risk to affected devices. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation, though no confirmed active exploitation (CISA KEV) has been reported at time of analysis.

Technical ContextAI

This vulnerability affects the Tenda CH22 wireless router (CPE: cpe:2.3:a:tenda:ch22), specifically firmware version 1.0.0.1. The root cause is CWE-121 (stack-based buffer overflow), a classic memory safety issue in embedded device firmware commonly written in C/C++. The vulnerable code resides in the formWrlExtraSet function, which handles wireless network configuration requests through the /goform/WrlExtraSet HTTP endpoint. When processing the 'GO' parameter, insufficient bounds checking allows an attacker to write beyond allocated stack buffer boundaries. In embedded router environments, stack overflows can overwrite return addresses and function pointers, enabling arbitrary code execution with the privileges of the web server process, typically root on consumer routers. The network-accessible attack vector (AV:N) combined with low attack complexity (AC:L) indicates this can be exploited through standard HTTP requests without requiring specialized conditions or race conditions.

RemediationAI

No vendor-released patch identified at time of analysis. Tenda has not published a security advisory or firmware update addressing CVE-2026-5605 in the provided reference data. Users should immediately check the official Tenda support website (https://www.tenda.com.cn/) and the CH22 product page for firmware updates newer than version 1.0.0.1. As interim mitigations: disable remote administration access to the router's web interface if enabled, restrict administrative access to trusted IP addresses only via firewall rules, change default credentials to strong unique passwords to raise the authentication barrier (though this does not eliminate risk for authenticated users), and consider network segmentation to isolate the vulnerable device from critical network segments. Organizations with security requirements should evaluate replacing affected hardware with products from vendors demonstrating active security maintenance. Monitor VulDB entry https://vuldb.com/vuln/355397 and GitHub repository https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_54/README.md for updates on patch availability or additional technical details.