CVE-2026-77031
HighCVSS 7.4Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
A vulnerability has been found in Tenda CH22 1.0.0.1 in the function formcreateFileName of the file /goform/formcreateFileName. Manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely execute arbitrary commands on the device, potentially leading to full compromise of the device and the network it is connected to.
Recommendation
Apply available firmware updates from the vendor. If not available, restrict access to the device from trusted networks and monitor logs for suspicious activity.
Other vulnerabilities in Tenda CH22
See all- CVE-2026-78141High
A vulnerability in Tenda CH22 1.0.0.1 in the formexeCommand function of the /goform/exeCommand file. Manipulation of the cmdinput argument leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-78063High
A security flaw was discovered in Tenda CH22 1.0.0.1. The function formeditFileName in /goform/editFileName is vulnerable to command injection via the editNameMit argument. The attack can be launched remotely and the exploit has been released publicly.
- CVE-2026-19346High
A vulnerability in Tenda CH22 1.0.0.1 allows command injection in the formCertListInfo function of /goform/CertListInfo. Manipulating the Name argument enables remote command execution. The exploit is public.
- CVE-2026-15543High
A buffer overflow vulnerability was found in Tenda CH22 version 1.0.0.1 in the formCertListInfo function of the /goform/CertListInfo file. An attacker can remotely manipulate the Name argument, causing a buffer overflow. The exploit has been made public and could be used.
- CVE-2026-5605High
A stack-based buffer overflow vulnerability was identified in the Tenda CH22 device version 1.0.0.1 in the formWrlExtraSet function of the /goform/WrlExtraSet file. The attack can be performed remotely by manipulating the GO argument. The exploit has been made public.
- CVE-2026-5604High
A security flaw has been discovered in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertLocalPrecreate in the file /goform/CertLocalPrecreate, where manipulation of the standard argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly released.
- CVE-2026-5204High
The Tenda CH22 router version 1.0.0.1 has a stack-based buffer overflow vulnerability in the formWebTypeLibrary function in /goform/webtypelibrary. Manipulating the webSiteId argument allows remote code execution. The exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.