CVE-2026-5605
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was identified in the Tenda CH22 device version 1.0.0.1 in the formWrlExtraSet function of the /goform/WrlExtraSet file. The attack can be performed remotely by manipulating the GO argument. The exploit has been made public.
Risk Assessment
A remote attack could lead to arbitrary code execution on the device, potentially resulting in full compromise of the device and network.
Recommendation
It is recommended to immediately disconnect the device from the network and contact the vendor for a firmware update or replace it with a supported model.
Other vulnerabilities in Tenda CH22
See all- CVE-2026-78141High
A vulnerability in Tenda CH22 1.0.0.1 in the formexeCommand function of the /goform/exeCommand file. Manipulation of the cmdinput argument leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-78063High
A security flaw was discovered in Tenda CH22 1.0.0.1. The function formeditFileName in /goform/editFileName is vulnerable to command injection via the editNameMit argument. The attack can be launched remotely and the exploit has been released publicly.
- CVE-2026-77031High
A vulnerability has been found in Tenda CH22 1.0.0.1 in the function formcreateFileName of the file /goform/formcreateFileName. Manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-19346High
A vulnerability in Tenda CH22 1.0.0.1 allows command injection in the formCertListInfo function of /goform/CertListInfo. Manipulating the Name argument enables remote command execution. The exploit is public.
- CVE-2026-15543High
A buffer overflow vulnerability was found in Tenda CH22 version 1.0.0.1 in the formCertListInfo function of the /goform/CertListInfo file. An attacker can remotely manipulate the Name argument, causing a buffer overflow. The exploit has been made public and could be used.
- CVE-2026-5604High
A security flaw has been discovered in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertLocalPrecreate in the file /goform/CertLocalPrecreate, where manipulation of the standard argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly released.
- CVE-2026-5204High
The Tenda CH22 router version 1.0.0.1 has a stack-based buffer overflow vulnerability in the formWebTypeLibrary function in /goform/webtypelibrary. Manipulating the webSiteId argument allows remote code execution. The exploit has been publicly disclosed.
Original NVD description (English source)
A weakness has been identified in Tenda CH22 1.0.0.1. This affects the function formWrlExtraSet of the file /goform/WrlExtraSet. Executing a manipulation of the argument GO can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.