CVE-2026-15543
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A buffer overflow vulnerability was found in Tenda CH22 version 1.0.0.1 in the formCertListInfo function of the /goform/CertListInfo file. An attacker can remotely manipulate the Name argument, causing a buffer overflow. The exploit has been made public and could be used.
Risk Assessment
The risk for the organization includes potential remote code execution or device crash, which could lead to network integrity compromise and data loss.
Recommendation
It is recommended to immediately apply a security update from the vendor or temporarily disable remote access to the device management interface.
Other vulnerabilities in Tenda CH22
See all- CVE-2026-78141High
A vulnerability in Tenda CH22 1.0.0.1 in the formexeCommand function of the /goform/exeCommand file. Manipulation of the cmdinput argument leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-78063High
A security flaw was discovered in Tenda CH22 1.0.0.1. The function formeditFileName in /goform/editFileName is vulnerable to command injection via the editNameMit argument. The attack can be launched remotely and the exploit has been released publicly.
- CVE-2026-77031High
A vulnerability has been found in Tenda CH22 1.0.0.1 in the function formcreateFileName of the file /goform/formcreateFileName. Manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-19346High
A vulnerability in Tenda CH22 1.0.0.1 allows command injection in the formCertListInfo function of /goform/CertListInfo. Manipulating the Name argument enables remote command execution. The exploit is public.
- CVE-2026-5605High
A stack-based buffer overflow vulnerability was identified in the Tenda CH22 device version 1.0.0.1 in the formWrlExtraSet function of the /goform/WrlExtraSet file. The attack can be performed remotely by manipulating the GO argument. The exploit has been made public.
- CVE-2026-5604High
A security flaw has been discovered in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertLocalPrecreate in the file /goform/CertLocalPrecreate, where manipulation of the standard argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly released.
- CVE-2026-5204High
The Tenda CH22 router version 1.0.0.1 has a stack-based buffer overflow vulnerability in the formWebTypeLibrary function in /goform/webtypelibrary. Manipulating the webSiteId argument allows remote code execution. The exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was found in Tenda CH22 1.0.0.1. This impacts the function formCertListInfo of the file /goform/CertListInfo. The manipulation of the argument Name results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.