Tenda EUVD-2026-17247

Tenda CH22 firmware versions 1.0.0.1/1.x. Attacker requires authenticated access to the device's web interface. Exploitation via POST request to /goform/setcfm endpoint with malicious funcname parameter causing stack buffer overflow in fromSetCfm function.

Real-world risk assessment requires synthesizing multiple signals. The CVSS 4.0 vector shows Network attack vector (AV:N) with Low complexity (AC:L) but requires Low privileges (PR:L), meaning an attacker needs valid authentication credentials before exploitation. The E:P (Proof-of-concept) modifier confirms public exploit availability via the GitHub repository referenced. While the CVSS base score of 7.4 suggests high severity, the authentication requirement significantly constrains the attack surface compared to unauthenticated remote code execution vulnerabilities. No CISA KEV listing indicates this is not confirmed as actively exploited in the wild, and no EPSS score is provided to quantify exploitation probability. However, the combination of public exploit code, low attack complexity, and the target being a consumer router (often poorly maintained with default credentials) elevates practical risk. SSVC considerations: exploitation status is POC-available, the attack is likely automatable once credentials are obtained, and technical impact is total system compromise (VC:H/VI:H/VA:H). This represents a credible threat primarily in scenarios where attackers have obtained credentials through credential stuffing, default password exploitation, or prior compromise. Priority should be high for environments where these routers are deployed, particularly in small office/home office contexts where credential hygiene is often weak.

An attacker who has obtained valid administrative credentials for a Tenda CH22 router (through credential stuffing, exploitation of default passwords, or social engineering) authenticates to the web interface and sends a specially crafted HTTP POST request to the /goform/setcfm endpoint. The malicious request contains an oversized 'funcname' parameter value designed to overflow the stack buffer in the fromSetCfm function handler, overwriting the return address with attacker-controlled values. This enables arbitrary code execution within the router's operating context, allowing the attacker to install persistent backdoors, modify firewall rules to enable further network penetration, intercept and manipulate network traffic passing through the router, or pivot to attack other devices on the internal network. Publicly available exploit code from the GitHub repository provides attackers with ready-to-use attack tools, significantly lowering the technical skill required for exploitation.