A function in the firmware, /goform/WriteFacMac, accepts a 'mac' parameter without proper validation. An attacker can inject arbitrary shell commands through this parameter, enabling remote code execution on the device. The vulnerability corresponds to command injection weaknesses, specifically CWE‑74 and CWE‑77. If exploited, the attacker can gain uncontrolled command execution, potentially compromising device configuration, network traffic, and the integrity of the router.

The affected device is the Tenda CH22 router running firmware version 1.0.0.1. The vulnerability appears to be limited to this specific firmware release, but any device that has not applied a patch from Tenda remains vulnerable.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS of 3% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but an exploit has already been published, implying that the attack vector is reachable remotely via the router’s web interface. The attacker would need to send a crafted request to the /goform/WriteFacMac endpoint with a malicious 'mac' parameter. Successful exploitation would give the attacker full command execution capabilities over the device.