Description
A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-08-20
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A command‑injection flaw exists in the Tenda CH22 firmware, specifically within the formcreateFileName function accessed via the /goform/formcreateFileName endpoint. The argument fileNameMit can be manipulated to inject and execute arbitrary operating‑system commands on the device. This vulnerability allows a remote attacker to run any command and potentially take full control of the router’s operating system, compromising confidentiality, integrity, and availability.

Affected Systems

The affected product is the Tenda CH22 router. Firmware version 1.0.0.1 is impacted. Vendors or deployments using this firmware revision are at risk.

Risk and Exploitability

The CVSS v3 score of 5.3 indicates moderate severity, while the EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog. The exploit is remote, initiated via the device’s web interface, and the public disclosure suggests that attackers could already be attempting to use it. Because the attack vector relies on input validation failures (CWE‑74 and CWE‑77), any exposed formcreateFileName endpoint imposes non‑negligible risk of arbitrary code execution.

Generated by OpenCVE AI on August 20, 2026 at 20:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update released by Tenda that patches the formcreateFileName command‑injection issue.
  • If an update is unavailable, block or restrict HTTP access to the /goform/formcreateFileName endpoint using the router’s ACLs or an external firewall so that only trusted internal addresses can reach it.
  • Consider disabling remote management or the web administration interface entirely until a patch is deployed, ensuring the device is isolated from untrusted networks.

Generated by OpenCVE AI on August 20, 2026 at 20:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Tenda ch22
Vendors & Products Tenda ch22

Thu, 20 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Title Tenda CH22 formcreateFileName command injection
First Time appeared Tenda
Tenda ch22 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:tenda:ch22_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda ch22 Firmware
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}

Subscriptions

Tenda Ch22 Ch22 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-20T18:28:50.477Z

Reserved: 2026-08-20T08:42:56.416Z

Link: CVE-2026-77031

cve-icon Vulnrichment

Updated: 2026-08-20T18:28:46.371Z

cve-icon NVD

Status : Received

Published: 2026-08-20T18:16:53.140

Modified: 2026-08-20T19:17:04.560

Link: CVE-2026-77031

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T20:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')