Description

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-09T10:17:10.567Z",
  "pubdate": "2026-08-09T10:17:10.567Z",
  "executiveSummary": "A critical command injection vulnerability has been identified in the Tenda CH22 router running firmware version 1.0.0.1. The security flaw resides within the formCertListInfo function located in the /goform/CertListInfo endpoint. Specifically, improper sanitization of user-supplied input passed via the Name argument allows an unauthenticated remote attacker to inject and execute arbitrary operating system commands with elevated privileges.\nThe successful exploitation of this vulnerability can lead to complete system compromise, allowing malicious actors to manipulate network traffic, access sensitive internal resources, or utilize the affected device as a pivot point in further network attacks. Because the exploit vector is exposed remotely and has been publicly disclosed, the risk profile of this vulnerability is exceptionally high. Remediation is complicated by the lack of an official vendor patch, necessitating strict network segmentation and edge-filtering controls to mitigate exposure.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw stemming from inadequate input validation and sanitization within the firmware binary handling web administrative requests. The affected component is the function formCertListInfo associated with the URI endpoint /goform/CertListInfo.\nDuring the execution flow, the application accepts HTTP parameters from remote clients, most notably the Name argument. This parameter is processed by the underlying firmware logic and subsequently passed to a system shell execution function, such as system() or popen(), without proper escaping or validation of meta-characters.\nAn unauthenticated remote attacker can exploit this weakness by crafting a malicious HTTP request directed at the /goform/CertListInfo endpoint. By appending shell metacharacters (such as semicolons, pipes, or backticks) followed by arbitrary system commands to the Name argument, the attacker can break out of the intended command context and force the underlying Linux-based operating system to execute payloads defined in the injected string.\nBecause the embedded web server and associated CGI binaries typically operate with root privileges to manage system certificates and network configurations, the injected commands inherit these elevated permissions. The attack vector requires network access to the device's management interface, which is commonly exposed via the WAN or LAN interfaces depending on device configuration. Public disclosure of functional exploit code significantly lowers the barrier to entry for potential threat actors, enabling automated scanning and exploitation."
}