Tenda EUVD-2026-17252

Requires authenticated access to Tenda CH22 router version 1.0.0.1. Attacker must send crafted request with malicious mit_linktype parameter to /goform/QuickIndex endpoint. No victim interaction needed. Remote exploitation via network.

Real-world risk is HIGH despite requiring low-privilege authentication (PR:L). The CVSS 3.1 score of 8.8 reflects network accessibility (AV:N), low attack complexity (AC:L), no user interaction required (UI:N), and complete impact to confidentiality, integrity, and availability (C:H/I:H/A:H). Critically, publicly available exploit code exists on GitHub, dramatically reducing the skill level required for exploitation and making this vulnerability automatable once initial authentication is obtained. While no EPSS score or CISA KEV status is provided in the input data, the combination of public exploit availability, low complexity, and remote attack vector suggests high real-world exploitation likelihood. Authentication requirements provide minimal protection since many Tenda routers ship with default credentials or weak passwords commonly found in credential-stuffing attacks. The SSVC technical impact is total (complete system compromise possible), and the vulnerability is demonstrably exploitable given the public proof-of-concept. Organizations using Tenda CH22 routers should treat this as an urgent remediation priority, especially if exposed to untrusted networks or using default credentials.

An external attacker performs credential stuffing against exposed Tenda CH22 router management interfaces using common default credentials or previously breached password databases. Upon successful authentication with low-privilege credentials to the web interface, the attacker accesses the publicly available exploit code from GitHub and modifies it to inject a reverse shell payload. By sending a crafted HTTP POST request to the /goform/QuickIndex endpoint with an oversized mit_linktype parameter value, the attacker triggers the stack-based buffer overflow, overwrites the return address, and executes arbitrary code with the privileges of the web server process. This grants complete control over the router, enabling the attacker to intercept network traffic, modify DNS settings to redirect users to phishing sites, establish persistent backdoor access, or pivot into the internal network to compromise additional systems. The low attack complexity and absence of required user interaction make this exploitable through automated scanning and exploitation frameworks.