EUVD-2026-20982
GHSA-m4j2-cxpj-8gp8
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 6.9 reflects a network-accessible vulnerability with low attack complexity and no authentication requirements (AV:N/AC:L/PR:N), but the impact scope is limited to confidentiality (VC:L) with no integrity or availability impact (VI:L/VA:L/SC:N/SI:N/SA:N). The presence of publicly available exploit code (E:P in vector) elevates practical exploitability. However, this is primarily an information disclosure vulnerability rather than a critical system compromise vector. Real-world risk depends on what sensitive data is accessible through the web root and whether Tenda CH22 devices are internet-exposed; devices on internal networks or behind NAT have reduced attack surface. The low scope indicates this does not cascade to system-wide compromise. |
| Exploit ScenarioDerived | An unauthenticated attacker on the network sends a crafted HTTP request to the vulnerable httpd component, including path traversal sequences (e.g., '../../etc/passwd') in the R7WebsSecurityHandlerfunction parameter. The flawed input validation allows the request to bypass directory restrictions and return sensitive files such as configuration data, credentials, or system files. Public exploit code on GitHub (https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_55/README.md) provides a working proof-of-concept, making this trivial for attackers to execute. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Remote path traversal in Tenda CH22 1.0.0.6(468) httpd component allows unauthenticated attackers to access arbitrary files via the R7WebsSecurityHandlerfunction, with publicly available exploit code and a CVSS score of 6.9 indicating moderate real-world risk despite the low scope of impact (information disclosure only).
RemediationAI
Firmware update from Tenda is the primary remediation. Users should visit https://www.tenda.com.cn/ to check for and apply the latest CH22 firmware version, as no specific patched version number is independently confirmed in available sources. In the interim, network-level mitigations include restricting external access to the CH22 device's web interface via firewall rules, segmenting the device to a trusted internal network only, and disabling remote management features if not required. Given the public availability of exploit code, patching should be prioritized.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the httpd web server component of Tenda CH22 (CPE: cpe:2.3:a:tenda:ch22:*:*:*:*:*:*:*:*), specifically within the R7WebsSecurityHandlerfunction function. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal flaw where user-supplied input is not properly validated before being used in file path operations. This allows an attacker to traverse directory structures using sequences like '../' to access files outside the intended web root, compromising confidentiality of sensitive system files and configuration data.
Know when Ch22 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in Tenda CH22 1.0.0.6(468). This issue affects the function R7WebsSecurityHandlerfunction of the component httpd. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Buffer overflow in the Tenda CH22 router (firmware 1.0.0.1) allows a remote, authenticated attacker to corrupt memory by
Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to execu
Stack-based buffer overflow in Tenda CH22 router version 1.0.0.1 allows authenticated remote attackers to achieve arbitr
Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to achie
Command injection in Tenda CH22 version 1.0.0.1 allows a remote low-privileged attacker to execute arbitrary OS commands
Command injection in Tenda CH22 firmware 1.0.0.1 allows low-privileged remote attackers to execute arbitrary OS commands
Command injection in Tenda CH22 firmware version 1.0.0.1 allows a low-privileged remote attacker to execute arbitrary OS
Exploit-DB