Which versions of Tenda are affected by EUVD-2026-17252?

Tenda CH22 router firmware version 1.0.0.1 contains a stack-based buffer overflow vulnerability (CVSS 8.8) that enables authenticated attackers to execute arbitrary code and gain full control of…

Is there a public PoC exploit available for EUVD-2026-17252?

Yes, a public proof-of-concept exploit is available for EUVD-2026-17252. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-17252?

Within 24 hours: Identify all Tenda CH22 devices running firmware version 1.0.0.1 across your network inventory using asset management tools and network scanning. Within 7 days: Contact Tenda support to confirm firmware availability status and timelines; implement network segmentation to restrict administrative access to affected routers to essential personnel only; disable remote management interfaces if operationally feasible. Within 30 days: Apply vendor-released firmware update immediately upon availability; conduct a full audit of affected router access logs for signs of exploitation; verify integrity of configuration backups.

Tenda EUVD-2026-17252

Q: What is the CVSS score of EUVD-2026-17252?

EUVD-2026-17252 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5156 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-30 VulDB

GHSA-q7wf-8q63-47pq

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 02, 2026 - 12:07 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 23:45 euvd

EUVD-2026-17252

Analysis Generated

Mar 30, 2026 - 23:45 vuln.today

CVE Published

Mar 30, 2026 - 23:30 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in Tenda CH22 1.0.0.1. This impacts the function formQuickIndex of the file /goform/QuickIndex of the component Parameter Handler. This manipulation of the argument mit_linktype causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. The vulnerability resides in the formQuickIndex function's handling of the mit_linktype parameter in the /goform/QuickIndex endpoint. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation. With a CVSS score of 8.8 and low attack complexity requiring only low-privilege authentication, this represents a critical risk to deployed Tenda CH22 devices, though CISA KEV status is not confirmed.

Technical ContextAI

This vulnerability affects the Tenda CH22 router (CPE: cpe:2.3:a:tenda:ch22:*:*:*:*:*:*:*:*) firmware version 1.0.0.1, specifically within the web management interface's parameter processing logic. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), occurring in the formQuickIndex function when processing the QuickIndex configuration endpoint at /goform/QuickIndex. The mit_linktype parameter lacks proper bounds checking, allowing an authenticated attacker to write beyond allocated stack memory boundaries. Stack-based buffer overflows are particularly dangerous in embedded systems like SOHO routers because they can overwrite return addresses and enable arbitrary code execution with the privileges of the web server process, typically running with elevated system access on router firmware. The network-accessible attack vector (AV:N) combined with the web interface exposure makes this exploitable from any network segment where an attacker can authenticate to the router's management interface.

RemediationAI

No vendor-released patch identified at time of analysis based on available data sources. Organizations should immediately implement compensatory controls including: disable remote management access to the router's web interface and restrict administrative access to trusted local network segments only; change default administrative credentials to strong, unique passwords; place affected Tenda CH22 devices behind additional network security controls such as firewalls that limit management interface exposure; monitor vendor security advisories at https://www.tenda.com.cn/ for future firmware updates addressing CVE-2026-5156; consider replacing affected devices with alternative router models if vendor support is unavailable or delayed. Network segmentation should isolate IoT and guest networks from critical infrastructure to limit lateral movement potential if exploitation occurs. Review authentication logs for suspicious access patterns to the /goform/QuickIndex endpoint as a detection measure.