EUVD-2026-63486
GHSA-j7w9-4ff7-r5qf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requiring low-privilege auth (PR:L); low impact triple reflects constrained embedded OS scope with no confirmed full-compromise path.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Command injection in Tenda CH22 firmware 1.0.0.1 allows low-privileged remote attackers to execute arbitrary OS commands by manipulating the fileNameMit parameter of the formcreateFileName function at the /goform/formcreateFileName endpoint. A public exploit proof-of-concept has been disclosed, making this actively weaponizable against unpatched devices. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires low-privileged authentication to the Tenda CH22 web management interface (confirmed by CVSS PR:L), consistent with valid device credentials - default, guessed, or previously compromised. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring low-level authentication - consistent with an authenticated web admin interface accessible over LAN or WAN. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privileged credentials to the Tenda CH22 web management interface - including default credentials common on consumer routers - sends a crafted HTTP POST request to /goform/formcreateFileName with shell metacharacters embedded in the fileNameMit parameter, causing the device's underlying OS to execute arbitrary commands. A public PoC on Notion demonstrates this technique, making exploitation reproducible without deep reverse engineering. … |
| Remediation | No vendor-released patch has been identified at time of analysis - the Tenda vendor advisory page (https://www.tenda.com.cn/) should be monitored for firmware updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to execu
Stack-based buffer overflow in Tenda CH22 router version 1.0.0.1 allows authenticated remote attackers to achieve arbitr
Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to achie
Buffer overflow in the Tenda CH22 router (firmware 1.0.0.1) allows a remote, authenticated attacker to corrupt memory by
Command injection in Tenda CH22 version 1.0.0.1 allows a remote low-privileged attacker to execute arbitrary OS commands
Command injection in Tenda CH22 firmware version 1.0.0.1 allows a low-privileged remote attacker to execute arbitrary OS
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today