The Tenda CH22 router running firmware 1.0.0.1 contains a flaw in the FormWriteFacMac function located at /goform/WriteFacMac. A crafted request that manipulates the mac parameter can inject arbitrary operating‑system commands, allowing an attacker to execute commands remotely on the device. The vulnerability is identified as a command injection weakness (CWE‑74, CWE‑77). Because the flaw is accessed through the web interface, a remote attacker can trigger it from any network that can reach the router’s administration port.

Affected devices are Tenda CH22 routers with firmware version 1.0.0.1. No other versions were mentioned, so all units running this firmware are considered vulnerable. The flaw is specific to the router’s web‑based configuration interface and does not affect other product lines.

The CVSS score of 5.3 places this issue in the medium severity range, and the exploit has already been demonstrated and published, indicating a realistic threat. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the public availability of an exploit suggests that the likelihood of real‑world attacks is non‑negligible. The likely attack vector is remote exploitation via HTTP requests to the router’s administrative interface from the Internet or an internal network that can reach the router.