Ch22 Firmware
Monthly
Denial of service in Tenda CH22 routers (firmware through 1.0.0.1) allows remote unauthenticated attackers to crash the device by sending a crafted request with a manipulated LISTLEN argument to the /goform/DhcpListClient endpoint. Publicly available exploit code exists per the referenced GitHub issue, and no CISA KEV entry has been recorded; EPSS is 4.58% (91st percentile), indicating above-average attention. Impact is confined to availability (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, vendor CVSS 4.0 base 5.5), with no confidentiality or integrity exposure, keeping real-world priority well below a code-execution flaw.
Unauthenticated path traversal in Tenda CH22 router firmware 1.0.0.1 permits remote attackers to manipulate file paths via the /public/ endpoint. Exploitation can result in limited file disclosure, modification, or deletion. Public exploit code is available, but no active exploitation has been confirmed and EPSS indicates low probability of widespread attacks.
A stack-based buffer overflow in the Tenda CH22 router's HTTP management service (firmware 1.0.0.1) lets an attacker crash or potentially execute code on the device by sending a crafted request to the /goform/L7Im endpoint with an oversized 'page' argument handled by the frmL7ImForm function. The vulnerability is network-reachable (AV:N) with low attack complexity and no user interaction, but per the assessed CVSS 4.0 vector it requires low-privilege authentication (PR:L), so the attacker must either hold valid credentials or reach a handler that is exposed pre-authentication - a constraint worth verifying, since many Tenda /goform handlers are reachable without login. Publicly available exploit code exists (published via a GitHub issue tracked in the NVD references), the EPSS score is 0.76% (54th percentile) indicating modest but non-trivial exploitation likelihood, and there is no CISA KEV listing, so active exploitation in the wild is not confirmed by the available data. Successful exploitation yields high confidentiality, integrity, and availability impact on the router itself, with no assessed impact to downstream connected systems.
A vulnerability was detected in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated remote attackers can exploit a buffer overflow in Tenda CH22 router firmware version 1.0.0.1 to potentially execute arbitrary code by manipulating the 'page' parameter in the /goform/NatStaticSetting endpoint. The vulnerability requires valid credentials to the web management interface and network reachability, with low attack complexity and no user interaction. Publicly available exploit code exists, but no active exploitation has been confirmed.
A buffer overflow in the Tenda CH22 router web management interface (firmware 1.0.0.1) lets a network-adjacent attacker who holds low-privilege credentials corrupt memory by sending a crafted 'page' parameter to the /goform/P2pListFilter endpoint, which is handled by the fromP2pListFilter function, potentially leading to code execution or device crash. The flaw is not confirmed as actively exploited (no CISA KEV listing), but publicly available exploit code exists and demonstrates the attack, so unpatched, internet- or LAN-exposed management interfaces should be treated as at risk. EPSS is low (0.71%, ~52nd percentile), and the independent assessment rates the issue a moderate priority given the authentication prerequisite and the typically LAN-limited reachability of the management endpoint.
Buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) allows an attacker with a low-privilege authenticated session on the device's HTTP management interface to manipulate the 'page' argument of the /goform/webExcptypemanFilter endpoint and overflow the buffer handled by fromwebExcptypemanFilter, achieving high impact on confidentiality, integrity, and availability. The issue is remotely reachable (CVSS 4.0 base 7.4; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and does not require user interaction, so exploitation is reliable once access is obtained. Publicly available exploit code exists (a public PoC is linked from the reporting references), but there is no confirmed active exploitation (CISA KEV), and EPSS is moderate at 1.01% (62nd percentile), indicating elevated but not top-tier risk.
An authenticated buffer overflow in the Tenda CH22 router's web management service (firmware 1.0.0.1) lets an attacker who can reach and log in to the device's HTTP interface corrupt memory via the 'page' argument to the /goform/addressNat handler, with the potential for code execution or denial of service. Publicly available exploit code exists (a PoC is published on GitHub), though exploitation requires network reachability to the admin interface and the low-privilege authentication implied by the PR:L vector; no CISA KEV entry confirms active exploitation, and EPSS is low at roughly 0.75% (54th percentile). Exposure is confined to CH22 firmware 1.0.0.1, and because the web UI is normally LAN-bound, real-world risk is moderate unless remote administration has been exposed to the WAN.
Buffer overflow in Tenda CH22 firmware 1.0.0.1 lets an authenticated remote attacker corrupt memory in the fromRouteStatic handler of the /goform/RouteStatic web endpoint by submitting an oversized 'page' argument, yielding high impact to the device's confidentiality, integrity, and availability (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploit code is publicly available (a GitHub PoC linked from the NVD entry), but there is no confirmation of active exploitation - the CVE is not in CISA KEV - and EPSS is only about 1.01% (62nd percentile), so predicted exploitation activity is moderate. Successful abuse requires a valid low-privilege web-UI session per the PR:L metric plus network reachability to the management interface, which on this SOHO router is LAN-side by default and only internet-reachable if the admin panel has been exposed to the WAN.
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interface via the /goform/VirtualSer endpoint's fromVirtualSer function, leading to high impact on confidentiality, integrity, and availability. The vulnerability requires valid management credentials (PR:L) and network access to the device's web interface, but is low-complexity and needs no user interaction. Publicly available exploit code exists, though EPSS is only 1.04% (63rd percentile), indicating moderate exploitation likelihood; no active exploitation has been confirmed in CISA KEV.
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code on the device by sending a crafted 'page' argument to the fromDhcpListClient handler reached through the /goform/DhcpListClient web endpoint. Per the assigned CVSS vector (PR:L), exploitation requires a low-privilege authenticated session on the web management interface, so the practical attack surface is limited to parties who can reach that interface (typically LAN-side, or WAN-side if remote management is enabled) and who hold valid credentials. Publicly available exploit code exists (a proof-of-concept linked from the advisory), and EPSS sits at 3.49% (89th percentile), indicating elevated relative interest, though there is no confirmed active exploitation (not in CISA KEV). The independent assessment rates the overall risk as moderate but credible, driven by the authentication prerequisite and the narrow affected firmware version rather than by confirmed in-the-wild activity.
Buffer overflow in Tenda CH22 router firmware 1.0.0.1 allows authenticated attackers on the adjacent network to execute arbitrary code with high impact to confidentiality, integrity, and availability. The vulnerability exists in the fromSetIpBind function accessible via /goform/SetIpBind endpoint when processing the 'page' parameter. A public proof-of-concept exploit has been published on GitHub, lowering the barrier to exploitation, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interface to corrupt memory by supplying an oversized 'page' argument to /goform/SafeMacFilter, potentially enabling arbitrary code execution or denial of service. Exploitation requires low-privilege authentication (CVSS PR:L) and network reachability to the device's admin panel, which is typically restricted to the LAN side. Publicly available exploit code exists; no vendor patch has been identified at time of analysis, and no active exploitation in the wild has been confirmed.
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or potentially execute code on the device by sending a crafted request to the /goform/SafeUrlFilter endpoint with an oversized 'page' argument processed by the fromSafeUrlFilter handler. Per the supplied CVSS vector (PR:L), exploitation requires a low-privilege authenticated session against the router's HTTP management interface, and no user interaction is needed; this authentication prerequisite is the primary limiting factor, and devices whose management interface is not reachable from the attacker's network segment are not exposed. Publicly available exploit code exists (referenced in a public GitHub issue), and EPSS estimates a 4.71% probability of exploitation activity (92nd percentile), though there is no CISA KEV confirmation of active exploitation and no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to the router's web management interface to corrupt memory via the page parameter in /goform/SafeClientFilter, potentially leading to code execution or denial of service. Exploitation requires network reachability to the management interface and, on typical deployments, is limited to LAN-side access unless remote WAN management is enabled. Publicly available exploit code exists (GitHub QIU-DIE/CVE issue #13), but there is no confirmed active exploitation (CISA KEV), and EPSS is 4.92% (92nd percentile).
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a crafted request to the /goform/SafeEmailFilter endpoint. Public exploit code exists, but no active exploitation has been confirmed (not in CISA KEV). The CVSS 4.0 base score is 8.9, reflecting high impact to confidentiality, integrity, and availability; EPSS is 0.86% (low likelihood).
Stack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to potentially execute arbitrary code by sending a crafted HTTP request to the /goform/AdvSetWrlsafeset endpoint with a malicious mit_ssid_index parameter. Publicly available exploit code exists, and the EPSS score is 6.71% (94th percentile), indicating elevated risk for exposed devices. Exploitation requires network access to the router's management interface, which is typically LAN-facing; Internet-based attacks depend on remote management being enabled or an attacker already on the local network.
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Critical stack-based buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1, affecting the formNatlimit function in the /goform/Natlimit endpoint. An authenticated remote attacker can exploit improper input validation on the 'page' parameter to achieve arbitrary code execution with full system privileges (confidentiality, integrity, and availability compromise). Public exploit code is available and the vulnerability meets active exploitation criteria.
Critical stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1 affecting the /goform/addUserName endpoint's Password parameter handling. An authenticated remote attacker can exploit this flaw to achieve complete system compromise including unauthorized access, data modification, and denial of service. Public exploit code has been disclosed and the vulnerability is actionable with low attack complexity, making it a high-priority threat.
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service in Tenda CH22 routers (firmware through 1.0.0.1) allows remote unauthenticated attackers to crash the device by sending a crafted request with a manipulated LISTLEN argument to the /goform/DhcpListClient endpoint. Publicly available exploit code exists per the referenced GitHub issue, and no CISA KEV entry has been recorded; EPSS is 4.58% (91st percentile), indicating above-average attention. Impact is confined to availability (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, vendor CVSS 4.0 base 5.5), with no confidentiality or integrity exposure, keeping real-world priority well below a code-execution flaw.
Unauthenticated path traversal in Tenda CH22 router firmware 1.0.0.1 permits remote attackers to manipulate file paths via the /public/ endpoint. Exploitation can result in limited file disclosure, modification, or deletion. Public exploit code is available, but no active exploitation has been confirmed and EPSS indicates low probability of widespread attacks.
A stack-based buffer overflow in the Tenda CH22 router's HTTP management service (firmware 1.0.0.1) lets an attacker crash or potentially execute code on the device by sending a crafted request to the /goform/L7Im endpoint with an oversized 'page' argument handled by the frmL7ImForm function. The vulnerability is network-reachable (AV:N) with low attack complexity and no user interaction, but per the assessed CVSS 4.0 vector it requires low-privilege authentication (PR:L), so the attacker must either hold valid credentials or reach a handler that is exposed pre-authentication - a constraint worth verifying, since many Tenda /goform handlers are reachable without login. Publicly available exploit code exists (published via a GitHub issue tracked in the NVD references), the EPSS score is 0.76% (54th percentile) indicating modest but non-trivial exploitation likelihood, and there is no CISA KEV listing, so active exploitation in the wild is not confirmed by the available data. Successful exploitation yields high confidentiality, integrity, and availability impact on the router itself, with no assessed impact to downstream connected systems.
A vulnerability was detected in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated remote attackers can exploit a buffer overflow in Tenda CH22 router firmware version 1.0.0.1 to potentially execute arbitrary code by manipulating the 'page' parameter in the /goform/NatStaticSetting endpoint. The vulnerability requires valid credentials to the web management interface and network reachability, with low attack complexity and no user interaction. Publicly available exploit code exists, but no active exploitation has been confirmed.
A buffer overflow in the Tenda CH22 router web management interface (firmware 1.0.0.1) lets a network-adjacent attacker who holds low-privilege credentials corrupt memory by sending a crafted 'page' parameter to the /goform/P2pListFilter endpoint, which is handled by the fromP2pListFilter function, potentially leading to code execution or device crash. The flaw is not confirmed as actively exploited (no CISA KEV listing), but publicly available exploit code exists and demonstrates the attack, so unpatched, internet- or LAN-exposed management interfaces should be treated as at risk. EPSS is low (0.71%, ~52nd percentile), and the independent assessment rates the issue a moderate priority given the authentication prerequisite and the typically LAN-limited reachability of the management endpoint.
Buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) allows an attacker with a low-privilege authenticated session on the device's HTTP management interface to manipulate the 'page' argument of the /goform/webExcptypemanFilter endpoint and overflow the buffer handled by fromwebExcptypemanFilter, achieving high impact on confidentiality, integrity, and availability. The issue is remotely reachable (CVSS 4.0 base 7.4; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and does not require user interaction, so exploitation is reliable once access is obtained. Publicly available exploit code exists (a public PoC is linked from the reporting references), but there is no confirmed active exploitation (CISA KEV), and EPSS is moderate at 1.01% (62nd percentile), indicating elevated but not top-tier risk.
An authenticated buffer overflow in the Tenda CH22 router's web management service (firmware 1.0.0.1) lets an attacker who can reach and log in to the device's HTTP interface corrupt memory via the 'page' argument to the /goform/addressNat handler, with the potential for code execution or denial of service. Publicly available exploit code exists (a PoC is published on GitHub), though exploitation requires network reachability to the admin interface and the low-privilege authentication implied by the PR:L vector; no CISA KEV entry confirms active exploitation, and EPSS is low at roughly 0.75% (54th percentile). Exposure is confined to CH22 firmware 1.0.0.1, and because the web UI is normally LAN-bound, real-world risk is moderate unless remote administration has been exposed to the WAN.
Buffer overflow in Tenda CH22 firmware 1.0.0.1 lets an authenticated remote attacker corrupt memory in the fromRouteStatic handler of the /goform/RouteStatic web endpoint by submitting an oversized 'page' argument, yielding high impact to the device's confidentiality, integrity, and availability (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploit code is publicly available (a GitHub PoC linked from the NVD entry), but there is no confirmation of active exploitation - the CVE is not in CISA KEV - and EPSS is only about 1.01% (62nd percentile), so predicted exploitation activity is moderate. Successful abuse requires a valid low-privilege web-UI session per the PR:L metric plus network reachability to the management interface, which on this SOHO router is LAN-side by default and only internet-reachable if the admin panel has been exposed to the WAN.
Authenticated remote attackers can trigger a buffer overflow in the Tenda CH22 (firmware 1.0.0.1) web management interface via the /goform/VirtualSer endpoint's fromVirtualSer function, leading to high impact on confidentiality, integrity, and availability. The vulnerability requires valid management credentials (PR:L) and network access to the device's web interface, but is low-complexity and needs no user interaction. Publicly available exploit code exists, though EPSS is only 1.04% (63rd percentile), indicating moderate exploitation likelihood; no active exploitation has been confirmed in CISA KEV.
A buffer overflow in the Tenda CH22 router firmware (version 1.0.0.1) lets attackers crash or potentially execute code on the device by sending a crafted 'page' argument to the fromDhcpListClient handler reached through the /goform/DhcpListClient web endpoint. Per the assigned CVSS vector (PR:L), exploitation requires a low-privilege authenticated session on the web management interface, so the practical attack surface is limited to parties who can reach that interface (typically LAN-side, or WAN-side if remote management is enabled) and who hold valid credentials. Publicly available exploit code exists (a proof-of-concept linked from the advisory), and EPSS sits at 3.49% (89th percentile), indicating elevated relative interest, though there is no confirmed active exploitation (not in CISA KEV). The independent assessment rates the overall risk as moderate but credible, driven by the authentication prerequisite and the narrow affected firmware version rather than by confirmed in-the-wild activity.
Buffer overflow in Tenda CH22 router firmware 1.0.0.1 allows authenticated attackers on the adjacent network to execute arbitrary code with high impact to confidentiality, integrity, and availability. The vulnerability exists in the fromSetIpBind function accessible via /goform/SetIpBind endpoint when processing the 'page' parameter. A public proof-of-concept exploit has been published on GitHub, lowering the barrier to exploitation, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an authenticated attacker with access to the web management interface to corrupt memory by supplying an oversized 'page' argument to /goform/SafeMacFilter, potentially enabling arbitrary code execution or denial of service. Exploitation requires low-privilege authentication (CVSS PR:L) and network reachability to the device's admin panel, which is typically restricted to the LAN side. Publicly available exploit code exists; no vendor patch has been identified at time of analysis, and no active exploitation in the wild has been confirmed.
A stack-based buffer overflow (CWE-119) in the Tenda CH22 router firmware version 1.0.0.1 lets remote attackers crash or potentially execute code on the device by sending a crafted request to the /goform/SafeUrlFilter endpoint with an oversized 'page' argument processed by the fromSafeUrlFilter handler. Per the supplied CVSS vector (PR:L), exploitation requires a low-privilege authenticated session against the router's HTTP management interface, and no user interaction is needed; this authentication prerequisite is the primary limiting factor, and devices whose management interface is not reachable from the attacker's network segment are not exposed. Publicly available exploit code exists (referenced in a public GitHub issue), and EPSS estimates a 4.71% probability of exploitation activity (92nd percentile), though there is no CISA KEV confirmation of active exploitation and no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in Tenda CH22 firmware 1.0.0.1 allows an attacker with low-privilege authenticated access to the router's web management interface to corrupt memory via the page parameter in /goform/SafeClientFilter, potentially leading to code execution or denial of service. Exploitation requires network reachability to the management interface and, on typical deployments, is limited to LAN-side access unless remote WAN management is enabled. Publicly available exploit code exists (GitHub QIU-DIE/CVE issue #13), but there is no confirmed active exploitation (CISA KEV), and EPSS is 4.92% (92nd percentile).
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a crafted request to the /goform/SafeEmailFilter endpoint. Public exploit code exists, but no active exploitation has been confirmed (not in CISA KEV). The CVSS 4.0 base score is 8.9, reflecting high impact to confidentiality, integrity, and availability; EPSS is 0.86% (low likelihood).
Stack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to potentially execute arbitrary code by sending a crafted HTTP request to the /goform/AdvSetWrlsafeset endpoint with a malicious mit_ssid_index parameter. Publicly available exploit code exists, and the EPSS score is 6.71% (94th percentile), indicating elevated risk for exposed devices. Exploitation requires network access to the router's management interface, which is typically LAN-facing; Internet-based attacks depend on remote management being enabled or an attacker already on the local network.
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was determined in Tenda CH22 1.0.0.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Tenda CH22 1.0.0.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Critical stack-based buffer overflow vulnerability in Tenda CH22 router firmware version 1.0.0.1, affecting the formNatlimit function in the /goform/Natlimit endpoint. An authenticated remote attacker can exploit improper input validation on the 'page' parameter to achieve arbitrary code execution with full system privileges (confidentiality, integrity, and availability compromise). Public exploit code is available and the vulnerability meets active exploitation criteria.
Critical stack-based buffer overflow vulnerability in Tenda CH22 version 1.0.0.1 affecting the /goform/addUserName endpoint's Password parameter handling. An authenticated remote attacker can exploit this flaw to achieve complete system compromise including unauthorized access, data modification, and denial of service. Public exploit code has been disclosed and the vulnerability is actionable with low attack complexity, making it a high-priority threat.
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.