Tenda EUVD-2026-17218

Requires authenticated access to Tenda CH22 router firmware version 1.0.0.1. Attacker must have valid login credentials to access the /goform/createFileName endpoint and send a crafted fileNameMit parameter to trigger stack-based buffer overflow.

Real-world risk is HIGH despite requiring authentication. The CVSS v4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with network-based attack vector (AV:N), low complexity (AC:L), and low-privilege requirements (PR:L). Critically, publicly available exploit code exists (confirmed by GitHub repository reference), dramatically reducing the skill level required for exploitation. The CVSS E:P (Proof-of-concept) modifier confirms weaponized code availability. Many Tenda routers ship with default credentials or weak password policies, effectively lowering the authentication barrier in practice. Once authenticated to the web interface (often accessible from LAN, sometimes WAN if remote management enabled), attackers can trigger the overflow to gain complete device control, pivot into internal networks, modify DNS settings for traffic interception, or establish persistent backdoors. The attack is automatable given the public exploit code. However, exploitation probability is somewhat constrained by the need for initial authentication and typical deployment behind NAT (limiting direct internet exposure). No CISA KEV listing indicates this is not confirmed as actively exploited in widespread campaigns at time of analysis, but the public exploit significantly elevates imminent risk for exposed devices.

An attacker first targets Tenda CH22 routers exposed via port forwarding or with remote management enabled, using credential stuffing with default Tenda credentials (admin/admin) or harvested passwords from breach databases. Once authenticated to the web management interface, the attacker crafts an HTTP POST request to /goform/createFileName with an oversized fileNameMit parameter containing shellcode. The formCreateFileName function copies this unchecked input into a stack buffer, overflowing into the return address. Upon function return, execution jumps to attacker-controlled shellcode, granting root-level access to the embedded Linux system. The attacker then installs a persistent backdoor, modifies DNS settings to redirect banking traffic to phishing sites, or uses the compromised router as a foothold to scan and attack other devices on the victim's internal network. The public GitHub exploit provides ready-to-use code requiring minimal modification.