Description
A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function fromAdvSetWan of the file /goform/AdvSetWan of the component Parameter Handler. The manipulation of the argument wanmode results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
Published: 2026-03-30
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a stack‑based buffer overflow in the fromAdvSetWan function of the Tenda CH22 firmware 1.0.0.1, triggered by overflowing the wanmode parameter in the /goform/AdvSetWan POST endpoint. An attacker can supply an oversized argument to corrupt the stack and arbitrary code execution on the device with the privileges of the web interface process, leading to full control over the router and the networks it connects.

Affected Systems

This flaw affects the Tenda CH22 router running firmware version 1.0.0.1. Any earlier firmware releases containing the same implementation of /goform/AdvSetWan are also vulnerable.

Risk and Exploitability

The CVSS base score is 8.7, indicating high severity, while the EPSS score is below 1%, suggesting a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The publicly available exploit can be executed remotely via crafted HTTP POST requests to the router’s web interface without local or administrative privileges.

Generated by OpenCVE AI on April 2, 2026 at 13:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update released by Tenda that addresses the stack buffer overflow in /goform/AdvSetWan.
  • If a patch is not yet available, restrict access to the router’s web interface by configuring a local firewall or access control list so only trusted IP addresses can reach /goform/AdvSetWan.
  • Disable or limit use of the wanmode parameter in the router’s configuration, or block the /goform/AdvSetWan endpoint with firewall rules if the option exists.
  • Monitor the router’s logs for repeated or abnormal POST requests to /goform/AdvSetWan and investigate any suspicious activity.

Generated by OpenCVE AI on April 2, 2026 at 13:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 02 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
CPEs cpe:2.3:h:tenda:ch22:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:ch22_firmware:1.0.0.1:*:*:*:*:*:*:*

Wed, 01 Apr 2026 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Tenda ch22
Vendors & Products Tenda ch22

Tue, 31 Mar 2026 03:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function fromAdvSetWan of the file /goform/AdvSetWan of the component Parameter Handler. The manipulation of the argument wanmode results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
Title Tenda CH22 Parameter AdvSetWan fromAdvSetWan stack-based overflow
First Time appeared Tenda
Tenda ch22 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:ch22_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda ch22 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Ch22 Ch22 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-02T14:14:14.801Z

Reserved: 2026-03-30T13:33:12.593Z

Link: CVE-2026-5155

cve-icon Vulnrichment

Updated: 2026-04-02T14:14:10.897Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-30T23:17:05.123

Modified: 2026-04-02T12:08:50.130

Link: CVE-2026-5155

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-02T20:22:47Z

Weaknesses