Tenda CH22 EUVD-2026-63486

Exploitation requires low-privileged authentication to the Tenda CH22 web management interface (confirmed by CVSS PR:L), consistent with valid device credentials - default, guessed, or previously compromised. No special non-default configuration is required beyond having the management interface reachable: the vulnerable endpoint /goform/formcreateFileName is part of the standard firmware. Exploitation is limited to: (1) possession of at least one set of valid credentials, (2) network access to the management interface (LAN by default; WAN if remote management is enabled). No user interaction is required beyond authentication. The attack complexity is Low (AC:L, AT:N), meaning no race conditions, timing dependencies, or non-standard configurations are needed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring low-level authentication - consistent with an authenticated web admin interface accessible over LAN or WAN. Impact is rated Low across all three dimensions (VC:L/VI:L/VA:L and SC:L/SI:L/SA:L), which likely reflects the constrained embedded OS environment, though command injection on a router can in practice yield full device control, privilege escalation, and persistent backdoors. The E:P supplemental metric confirms public PoC availability, materially elevating exploitation likelihood. No EPSS data was provided in the intelligence feed and KEV status is absent, suggesting no confirmed mass exploitation yet. The primary real-world risk concentrates on internet-exposed management interfaces and SMB environments where default or weak credentials are common. The missing EPSS score and absent vendor advisory are gaps that limit confidence in quantifying broader risk.

An attacker with low-privileged credentials to the Tenda CH22 web management interface - including default credentials common on consumer routers - sends a crafted HTTP POST request to /goform/formcreateFileName with shell metacharacters embedded in the fileNameMit parameter, causing the device's underlying OS to execute arbitrary commands. A public PoC on Notion demonstrates this technique, making exploitation reproducible without deep reverse engineering. The attacker could use this foothold to establish a persistent backdoor, pivot to the internal network, or exfiltrate device configuration including Wi-Fi PSKs.