Description

A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the argument editNameMit results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-23T05:16:53.273Z",
  "pubdate": "2026-08-23T05:16:53.273Z",
  "executiveSummary": "A critical security flaw involving command injection has been identified in the Tenda CH22 1.0.0.1 firmware. The vulnerability resides within the form handling functionality exposed via the web interface. Specifically, the flaw affects the formeditFileName function located in the /goform/editFileName file, where improper sanitization of user-supplied input allows arbitrary system command execution.\nThe primary impact of this vulnerability is complete remote code execution (RCE) on the underlying operating system of the affected device. An unauthenticated remote attacker can leverage this flaw to compromise the integrity, availability, and confidentiality of the targeted network device.\nThe affected product is the Tenda CH22 version 1.0.0.1. Because the exploit mechanism has been publicly disclosed, the risk implications are exceptionally high, as automated scanners and malicious actors actively scan for vulnerable endpoints.\nExploitation of this vulnerability requires network access to the target device's management interface. The attack can be launched remotely over the network without requiring prior authentication or valid user credentials, significantly lowering the attack complexity for malicious actors seeking to establish persistent access within the local network perimeter.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw stemming from insufficient input validation and sanitization within the firmware binary. The specific vulnerable component is the formeditFileName function contained within the /goform/editFileName endpoint of the Tenda CH22 1.0.0.1 web application server.\nThe root cause of the vulnerability lies in the insecure handling of parameters passed to the underlying operating system shell. During the execution of the formeditFileName routine, the application processes HTTP requests containing the editNameMit argument. The values supplied within this parameter are concatenated or passed directly into system execution functions, such as popen() or system(), without proper neutralization of shell metacharacters.\nThe attack flow proceeds as follows: an attacker crafts an HTTP request targeting the /goform/editFileName endpoint. Within this request, the attacker injects malicious shell commands payload appended to or disguised as the editNameMit argument. When the web application parses the input, the unsanitized payload is interpreted directly by the underlying shell environment. This results in the execution of arbitrary commands with the privileges of the web server process, which typically runs with root or high-level administrative privileges on embedded routers and IoT devices.\nNetwork exposure is fully remote, as the affected web management interface is typically accessible over standard HTTP protocols on local area networks or, in misconfigured environments, directly exposed to the wide area network (WAN). The attack requires zero authentication credentials and no special privilege levels, allowing any network-adjacent or remotely connected entity to issue the malicious payload.\nThe post-exploitation impact includes full system compromise, potential pivoting into the internal network, manipulation of device configurations, denial of service through system crashes, and establishment of persistent backdoors within the embedded operating system environment."
}