Description
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formWrlExtraGet of the file /goform/GstDhcpSetSer. This manipulation of the argument dips causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Affected products
tenda: ch22 firmware; tenda: ch22
References5
- github.com/zhaoyinshan/CVE/issues/2 ExploitThird Party Advisory
- vuldb.com/?ctiid.326198 Permissions RequiredVDB Entry
- vuldb.com/?id.326198 Third Party AdvisoryVDB Entry
- vuldb.com/?submit.662927 Third Party AdvisoryVDB Entry
- www.tenda.com.cn/ Product
Metrics
- CVSS 3.1
-
8.8
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0
-
7.4
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 57 · as of 9 November 2026
- CWE
- CWE-119CWE-120
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.