A flaw exists in the Tenda CH22 router that allows injection of arbitrary system commands through the editNameMit parameter of the /goform/editFileName endpoint. This command‑injection weakness (CWE-74 and CWE-77) can be exploited from a remote address, potentially granting an attacker full control over the device or causing a denial of service. The description does not explicitly state the extent of damage, but based on the nature of command injection, it is inferred that an attacker could execute any privileged command available to the router’s operating system.

The vulnerability applies to the Tenda CH22 router running firmware version 1.0.0.1. The CPE identifier confirms that this specific firmware is targeted. No additional firmware revisions or models are mentioned as affected in the advisory.

The severity rating of 5.3 on the CVSS base vector indicates moderate risk. The EPSS score is unavailable, yet the advisory notes that a public exploit has been released, implying a non‑negligible likelihood of real‑world attacks. Because the attack vector is a remotely accessible HTTP interface, attackers can reach the vulnerable payload without any privileged network position. The vulnerability is not yet tracked in the CISA KEV catalog, but the public availability of exploitation code raises the priority for immediate assessment and mitigation.