A stack-based buffer overflow occurs when the webSiteId parameter is processed by the Tenda CH22’s formWebTypeLibrary handler. This flaw can be triggered remotely via an HTTP request to the /goform/webtypelibrary endpoint, leading to memory corruption and the potential execution of arbitrary code on the device. The exploit has been publicly disclosed and is known to be usable by attackers.

This vulnerability affects the Tenda CH22 router running firmware version 1.0.0.1. No other firmware versions are listed as affected, so the impact is confined to devices with this specific build.

The CVSS score of 8.7 denotes a high severity, and the EPSS score of less than 1% indicates that exploitation is rare at present, though the attack can be initiated from anywhere on the network. The vulnerability is not catalogued in the CISA Known Exploited Vulnerabilities list, but the remote nature of the attack vector and the potential for full system compromise make it a high‑risk issue.