CVE-2026-5604

A vulnerability has been found in Tenda CH22 up to 1.0.0.1. Affected is the function fromDhcpListClient of the file /goform/DhcpListClient. Manipulation of the argument LISTLEN leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public.

A security vulnerability has been detected in Tenda CH22 up to 1.0.0.1. This issue affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset, where manipulation of the mit_ssid_index argument leads to a stack-based buffer overflow. The attack may be initiated remotely and the exploit has been disclosed publicly.

A vulnerability in Tenda CH22 1.0.0.1 in the formexeCommand function of the /goform/exeCommand file. Manipulation of the cmdinput argument leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

A security flaw was discovered in Tenda CH22 1.0.0.1. The function formeditFileName in /goform/editFileName is vulnerable to command injection via the editNameMit argument. The attack can be launched remotely and the exploit has been released publicly.

A vulnerability has been found in Tenda CH22 1.0.0.1 in the function formcreateFileName of the file /goform/formcreateFileName. Manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability in Tenda CH22 1.0.0.1 allows command injection in the formCertListInfo function of /goform/CertListInfo. Manipulating the Name argument enables remote command execution. The exploit is public.

A buffer overflow vulnerability was found in Tenda CH22 version 1.0.0.1 in the formCertListInfo function of the /goform/CertListInfo file. An attacker can remotely manipulate the Name argument, causing a buffer overflow. The exploit has been made public and could be used.

A stack-based buffer overflow vulnerability was identified in the Tenda CH22 device version 1.0.0.1 in the formWrlExtraSet function of the /goform/WrlExtraSet file. The attack can be performed remotely by manipulating the GO argument. The exploit has been made public.

The Tenda CH22 router version 1.0.0.1 has a stack-based buffer overflow vulnerability in the formWebTypeLibrary function in /goform/webtypelibrary. Manipulating the webSiteId argument allows remote code execution. The exploit has been publicly disclosed.

A buffer overflow vulnerability was detected in Tenda CH22 in the fromP2pListFilter function of /goform/P2pListFilter, caused by manipulation of the page argument. Remote exploitation is possible, and the exploit has been publicly disclosed.