The vulnerability is a stack-based buffer overflow in the formCertLocalPrecreate function of the Parameter Handler module in Tenda CH22 firmware. By manipulating the standard argument of the /goform/CertLocalPrecreate endpoint, an attacker can trigger the overrun and achieve arbitrary code execution on the device. The flaw permits remote exploitation, allowing a threat actor to target the router from outside the local network without authentication.

This issue affects the Tenda CH22 router running firmware version 1.0.0.1. The vulnerability resides in the Parameter Handler component’s web interface, exposed through the /goform/CertLocalPrecreate URI. No other firmware releases are listed as impacted.

The CVSS base score of 8.7 indicates high severity. The exploit has been publicly released and may be used by attackers, though the EPSS score is not available and the vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires network connectivity to the device’s web management interface; once the buffer overflow is triggered, an attacker can execute arbitrary code with system privileges on the router.