Description

A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-20T18:16:53.140Z",
  "pubdate": "2026-08-20T18:16:53.140Z",
  "executiveSummary": "A critical remote command injection vulnerability has been identified in the Tenda CH22 router running firmware version 1.0.0.1. The flaw resides within the formcreateFileName function exposed via the web interface endpoint at /goform/formcreateFileName. Specifically, improper input sanitization of the fileNameMit argument allows malicious actors to supply arbitrary system commands alongside or instead of expected input. Successful exploitation of this vulnerability results in remote code execution with the privileges of the underlying web server, typically root. This poses severe risk implications, including full device compromise, unauthorized access to internal network segments, potential device hijacking into botnets, and complete loss of confidentiality, integrity, and availability. The attack vector is fully network-accessible, allowing remote attackers to initiate exploitation without prior authentication if network boundaries permit access to the device management interface. Given that exploit details have been publicly disclosed, the likelihood of active exploitation is exceptionally high. Remediation requires strict input validation and sanitization within the vulnerable binary to prevent shell metacharacter interpretation.",
  "technicalDetails": "The vulnerability is an OS command injection flaw categorized by improper neutralization of special elements used in an OS command. The affected software component is the binary implementing the web server functionality of the Tenda CH22 router, specifically targeting the /goform/formcreateFileName URI endpoint and its associated handler function formcreateFileName. The root cause of the vulnerability stems from insecure coding practices where user-supplied input provided via the HTTP parameter fileNameMit is concatenated directly or passed unsanitized into a dynamic command execution sink, such as the C library function system() or popen(), executed by the underlying operating system shell.\nThe attack flow begins when an attacker crafts a malicious HTTP request directed at the network-exposed endpoint /goform/formcreateFileName. The request includes an engineered payload injected into the fileNameMit parameter containing shell metacharacters (such as semicolons, pipe symbols, or backticks) followed by arbitrary system commands. Upon receiving the HTTP request, the web server passes the raw, unvalidated parameter value directly to the internal formcreateFileName function. This function processes the input and constructs a system command string without performing adequate lexical analysis, escaping, or allow-listing.\nWhen the operating system evaluates the constructed command string, the embedded shell metacharacters alter the intended command logic, causing the shell to execute the attacker's payload in addition to or instead of the legitimate administrative operation. Because embedded router firmware typically runs critical management services with high-privilege execution contexts, the injected commands execute with root privileges. Consequently, the post-exploitation impact includes full control over the device operating system, persistent backdoors, ability to modify device configurations, interception of network traffic passing through the router, and pivoting capabilities into the local area network. Authentication and privilege requirements for exploitation are minimal to none, as the endpoint is exposed remotely over the network."
}