Ch22
Monthly
Buffer overflow in the Tenda CH22 router (firmware 1.0.0.1) allows a remote, authenticated attacker to corrupt memory by supplying an overlong 'Name' argument to the formCertListInfo function in the /goform/CertListInfo endpoint. The flaw was disclosed by VulDB with publicly available exploit code, and the CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact. No public exploit identified in CISA KEV, so this is a proof-of-concept-stage issue rather than confirmed in-the-wild abuse.
Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to achieve arbitrary code execution via the formWrlExtraSet function. The vulnerability resides in the /goform/WrlExtraSet endpoint where manipulation of the 'GO' parameter triggers memory corruption. With CVSS 8.8 (network-accessible, low complexity, requires low-privileged authentication), this represents a critical risk to affected devices. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation, though no confirmed active exploitation (CISA KEV) has been reported at time of analysis.
Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to execute arbitrary code via crafted 'standard' parameter to the formCertLocalPrecreate function in /goform/CertLocalPrecreate endpoint. Publicly available exploit code exists (GitHub), CVSS 7.4 (High), but no active exploitation confirmed (not in CISA KEV). CVSS vector indicates low attack complexity with required authentication (PR:L), affecting all three confidentiality, integrity, and availability at high impact levels.
Stack-based buffer overflow in Tenda CH22 router version 1.0.0.1 allows authenticated remote attackers to achieve arbitrary code execution via the webSiteId parameter in the formWebTypeLibrary function. Public exploit code exists on GitHub, significantly lowering the barrier to exploitation. While requiring low-privilege authentication (PR:L), the vulnerability enables complete compromise of router confidentiality, integrity, and availability with low attack complexity.
Command injection in Tenda CH22 firmware version 1.0.0.1 allows a low-privileged remote attacker to execute arbitrary OS-level commands via the cmdinput parameter of the /goform/exeCommand endpoint. The underlying formexeCommand function passes user-controlled input to a system command without adequate sanitization, exposing the router's underlying Linux OS. A proof-of-concept exploit has been publicly disclosed on Notion (referenced via VulDB), elevating real-world risk beyond the moderate CVSS 4.0 score of 5.3, which appears to understate the practical OS-level impact typical of router command injection primitives.
Command injection in Tenda CH22 version 1.0.0.1 allows a remote low-privileged attacker to execute arbitrary OS commands by manipulating the `editNameMit` parameter within the `formeditFileName` function at the `/goform/editFileName` web management endpoint. A public proof-of-concept exploit has been released, confirmed by the CVSS 4.0 E:P modifier and a linked Notion-hosted exploit writeup. No CISA KEV listing at time of analysis, but the public PoC significantly lowers the skill bar for exploitation against any CH22 device with an exposed or accessible management interface.
Command injection in Tenda CH22 firmware 1.0.0.1 allows low-privileged remote attackers to execute arbitrary OS commands by manipulating the fileNameMit parameter of the formcreateFileName function at the /goform/formcreateFileName endpoint. A public exploit proof-of-concept has been disclosed, making this actively weaponizable against unpatched devices. No patch has been confirmed by the vendor at time of analysis.
Buffer overflow in the Tenda CH22 router (firmware 1.0.0.1) allows a remote, authenticated attacker to corrupt memory by supplying an overlong 'Name' argument to the formCertListInfo function in the /goform/CertListInfo endpoint. The flaw was disclosed by VulDB with publicly available exploit code, and the CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact. No public exploit identified in CISA KEV, so this is a proof-of-concept-stage issue rather than confirmed in-the-wild abuse.
Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to achieve arbitrary code execution via the formWrlExtraSet function. The vulnerability resides in the /goform/WrlExtraSet endpoint where manipulation of the 'GO' parameter triggers memory corruption. With CVSS 8.8 (network-accessible, low complexity, requires low-privileged authentication), this represents a critical risk to affected devices. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation, though no confirmed active exploitation (CISA KEV) has been reported at time of analysis.
Stack-based buffer overflow in Tenda CH22 router firmware version 1.0.0.1 allows authenticated remote attackers to execute arbitrary code via crafted 'standard' parameter to the formCertLocalPrecreate function in /goform/CertLocalPrecreate endpoint. Publicly available exploit code exists (GitHub), CVSS 7.4 (High), but no active exploitation confirmed (not in CISA KEV). CVSS vector indicates low attack complexity with required authentication (PR:L), affecting all three confidentiality, integrity, and availability at high impact levels.
Stack-based buffer overflow in Tenda CH22 router version 1.0.0.1 allows authenticated remote attackers to achieve arbitrary code execution via the webSiteId parameter in the formWebTypeLibrary function. Public exploit code exists on GitHub, significantly lowering the barrier to exploitation. While requiring low-privilege authentication (PR:L), the vulnerability enables complete compromise of router confidentiality, integrity, and availability with low attack complexity.
Command injection in Tenda CH22 firmware version 1.0.0.1 allows a low-privileged remote attacker to execute arbitrary OS-level commands via the cmdinput parameter of the /goform/exeCommand endpoint. The underlying formexeCommand function passes user-controlled input to a system command without adequate sanitization, exposing the router's underlying Linux OS. A proof-of-concept exploit has been publicly disclosed on Notion (referenced via VulDB), elevating real-world risk beyond the moderate CVSS 4.0 score of 5.3, which appears to understate the practical OS-level impact typical of router command injection primitives.
Command injection in Tenda CH22 version 1.0.0.1 allows a remote low-privileged attacker to execute arbitrary OS commands by manipulating the `editNameMit` parameter within the `formeditFileName` function at the `/goform/editFileName` web management endpoint. A public proof-of-concept exploit has been released, confirmed by the CVSS 4.0 E:P modifier and a linked Notion-hosted exploit writeup. No CISA KEV listing at time of analysis, but the public PoC significantly lowers the skill bar for exploitation against any CH22 device with an exposed or accessible management interface.
Command injection in Tenda CH22 firmware 1.0.0.1 allows low-privileged remote attackers to execute arbitrary OS commands by manipulating the fileNameMit parameter of the formcreateFileName function at the /goform/formcreateFileName endpoint. A public exploit proof-of-concept has been disclosed, making this actively weaponizable against unpatched devices. No patch has been confirmed by the vendor at time of analysis.