EUVD-2026-43301
GHSA-mg6v-gcmc-mw8w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend crafted POST to /goform/CertListInfo
-
ExecutionOverflow buffer via oversized Name argument
-
PersistCorrupt memory / hijack execution
-
ImpactCompromise device or cause denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the router's HTTP management service and submit a request to the /goform/CertListInfo endpoint invoking formCertListInfo with an oversized 'Name' parameter. The CVSS vector specifies PR:L, so low-privilege authentication (a valid but non-administrative web-UI session/credential) is required - it is NOT unauthenticated against default configurations. Limiting factors: the management interface must be network-reachable to the attacker (typically LAN-side unless remote administration is enabled), the device must run firmware 1.0.0.1, and the attacker must hold at least low-level credentials or an authenticated session; no user interaction is needed (UI:N). |
| Impact | Signals are moderately consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC/VI/VA:H) indicates network-reachable, low-complexity exploitation requiring only low-level authentication and yielding full compromise of the device - hence the 8.7 High score. The vector's E:P (Proof-of-Concept) exploit-maturity flag aligns with the reported public POC on the Notion writeup. No EPSS score was provided in the input, and there is no CISA KEV listing, so predicted/observed exploitation velocity is unquantified. The PR:L requirement is an important limiter: an attacker needs valid (even low-privilege) credentials or session access to the router's web UI, which reduces the fully-anonymous internet-scan risk. This is a real priority for exposed or credential-weak devices but not an unauthenticated wormable flaw. Note: VulDB is the sole reporter and no independent vendor advisory confirms the details - verify before treating specifics as authoritative. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the CH22 web interface (or on the same network segment as an exposed management port) sends a crafted POST to /goform/CertListInfo with an oversized 'Name' argument, overflowing the target buffer. Because public exploit code exists on the referenced Notion writeup, the attacker can reliably trigger a crash or attempt code execution to seize control of the router. Given the low attack complexity, this can be scripted against any reachable, credentialed device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Buffer overflow in the Tenda CH22 router (firmware 1.0.0.1) allows a remote, authenticated attacker to corrupt memory by supplying an overlong 'Name' argument to the formCertListInfo function in the /goform/CertListInfo endpoint. The flaw was disclosed by VulDB with publicly available exploit code, and the CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact. No public exploit identified in CISA KEV, so this is a proof-of-concept-stage issue rather than confirmed in-the-wild abuse.
RemediationAI
No vendor-released patch identified at time of analysis; no fixed firmware version is cited in the input data, so contact Tenda (https://www.tenda.com.cn/) for updated CH22 firmware and monitor for a release addressing the /goform/CertListInfo handler. As compensating controls, restrict access to the router's web management interface to trusted LAN hosts only and disable any remote/WAN-side administration so the /goform endpoint is unreachable from the internet - this blocks the network attack vector at the cost of remote manageability. Enforce strong, unique administrative credentials and rotate any default passwords, since exploitation requires low-privilege authentication (PR:L); this raises the bar for an attacker who would otherwise reach the endpoint with a weak session. Where feasible, place the device behind a firewall segment and log/alert on requests to /goform/CertListInfo. Reference the disclosure at https://vuldb.com/vuln/377893 for tracking.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda CH22 is a SOHO/consumer wireless router whose web management interface is served by a 'goform' CGI-style handler. The vulnerable routine formCertListInfo processes the /goform/CertListInfo request and copies the attacker-controlled 'Name' parameter into a fixed-size stack or global buffer without bounds checking. This maps to CWE-120 (Buffer Copy without Checking Size of Input, the classic 'Classic Buffer Overflow'), a memory-safety defect endemic to embedded MIPS/ARM firmware written in C where user input is handled with unsafe copy primitives like strcpy/sprintf. The single affected product per CPE data is cpe:2.3:a:tenda:ch22 across firmware 1.0.0.1.
Know when Ch22 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable low-complexity endpoint needing low-privilege web-UI auth (PR:L), no user interaction, with full device compromise giving high C/I/A.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in Tenda CH22 1.0.0.1. This impacts the function formCertListInfo of the file /goform/CertListInfo. The manipulation of the argument Name results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
Executive ViewAI
A buffer overflow vulnerability (CVE-2026-15543) in Tenda CH22 routers (firmware 1.0.0.1) allows authenticated attackers to corrupt memory with publicly available exploit code, affecting confidentiality, integrity, and availability. With no vendor patch released and a CVSS score of 8.7, organizations deploying these devices face ongoing risk to network stability and data security.
Restrict network access to the Tenda CH22 management interface and /goform/CertListInfo endpoint through firewall rules and network segmentation. Implement multi-factor authentication for administrative access where supported. Deploy intrusion detection systems configured to detect buffer overflow exploitation patterns. Maintain detailed audit logs of all access attempts to the vulnerable endpoint. If operationally feasible, disable the /goform/CertListInfo service entirely until replacement hardware is deployed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to execu
Stack-based buffer overflow in Tenda CH22 router version 1.0.0.1 allows authenticated remote attackers to achieve arbitr
Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to achie
Remote path traversal in Tenda CH22 1.0.0.6(468) httpd component allows unauthenticated attackers to access arbitrary fi
Command injection in Tenda CH22 version 1.0.0.1 allows a remote low-privileged attacker to execute arbitrary OS commands
Command injection in Tenda CH22 firmware 1.0.0.1 allows low-privileged remote attackers to execute arbitrary OS commands
Command injection in Tenda CH22 firmware version 1.0.0.1 allows a low-privileged remote attacker to execute arbitrary OS
Exploit-DB