EUVD-2026-17243
GHSA-cg57-rmwp-qvm9
5.3
CVSS 4.0
Share
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X
Lifecycle Timeline
4
PoC Detected
Apr 02, 2026 - 12:09 vuln.today
Public exploit code
Analysis Generated
Mar 30, 2026 - 21:45 vuln.today
EUVD ID Assigned
Mar 30, 2026 - 21:45 euvd
EUVD-2026-17243
CVE Published
Mar 30, 2026 - 21:30 nvd
MEDIUM 5.3
Tags
Description
A flaw has been found in Tenda CH22 1.0.0.1. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. Executing a manipulation of the argument mac can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used.
Analysis
Command injection in Tenda CH22 1.0.0.1 via the FormWriteFacMac function allows authenticated remote attackers to execute arbitrary commands by manipulating the mac parameter in the /goform/WriteFacMac endpoint. Publicly available exploit code exists for this vulnerability, which carries a CVSS score of 6.3 and requires low-privilege authentication to trigger.
Sign in for full analysis, threat intelligence, and remediation guidance.
Priority Score
49
Low
Medium
High
Critical
KEV: 0
EPSS: +2.7
CVSS: +26
POC: +20
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).