Description

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-23T22:16:32.667Z",
  "pubdate": "2026-08-23T22:16:32.667Z",
  "executiveSummary": "A critical remote command injection vulnerability has been identified in the Tenda CH22 router running firmware version 1.0.0.1. The flaw resides in the formexeCommand function exposed via the web interface at the /goform/exeCommand endpoint. Specifically, improper input sanitization and validation of the cmdinput parameter allow an unauthenticated remote attacker to inject arbitrary operating system commands, which are subsequently executed with the privileges of the underlying web server process, typically root.\nThe presence of this vulnerability introduces severe risk implications, potentially leading to complete system compromise, unauthorized access to internal network resources, data exfiltration, and the integration of the affected device into malicious botnets. Because the attack vector is exposed remotely over the network and exploits are publicly disclosed, immediate remediation is imperative to prevent widespread exploitation. Successful exploitation requires network connectivity to the target device's administration interface, but does not inherently require valid user credentials or pre-existing access, making it highly attractive to automated threat actors.",
  "technicalDetails": "The vulnerability is classified as an OS Command Injection flaw stemming from insufficient neutralization of user-supplied input within the binary or script handling the /goform/exeCommand endpoint. The vulnerable component is the formexeCommand function, which processes HTTP requests directed at the specified URI.\nDuring the execution flow, the application extracts the value provided in the cmdinput parameter from the incoming HTTP request. Instead of employing safe API calls, parameterized execution, or strict whitelist validation, the vulnerable function concatenates or passes the raw cmdinput string directly into a system shell execution routine, such as system() or popen().\nTo exploit this vulnerability, an attacker crafts an HTTP request targeting the /goform/exeCommand endpoint. By appending shell metacharacters, command separators (such as semicolons, pipes, or backticks), and malicious payload strings to the cmdinput parameter, the attacker can break out of the intended command context and append arbitrary operating system commands.\nThe attack flow proceeds as follows: 1) The attacker sends a crafted HTTP GET or POST request containing the malicious payload in the cmdinput parameter across the network to the Tenda CH22 device. 2) The HTTP server daemon routes the request to the formexeCommand function within the application binary. 3) The function extracts the unsanitized cmdinput value and constructs a system command string. 4) The underlying operating system shell executes the constructed string, running both the intended diagnostic or administrative command alongside the attacker-injected payload. 5) The command executes with high privileges (typically root), allowing the attacker to establish reverse shells, modify system configurations, or deploy persistent malware.\nThe affected product is Tenda CH22 version 1.0.0.1. The vulnerability requires network exposure, typically affecting WAN or LAN interfaces depending on the device configuration and firewall rules. No authentication is required to interact with the vulnerable endpoint, lowering the barrier to exploitation."
}