Cyber Posture

CVE-2026-5204

HighPublic PoC

Published: 31 March 2026

Published
31 March 2026
Modified
02 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 28.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack can be initiated remotely. The exploit…

more

has been publicly disclosed and may be utilized.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires validation of the webSiteId parameter input to the formWebTypeLibrary function, directly preventing the stack-based buffer overflow from malicious manipulation.

prevent

Implements memory protections such as stack canaries and address space layout randomization to mitigate exploitation of the stack-based buffer overflow even if invalid input is processed.

prevent

Mandates timely identification, reporting, and patching of the publicly disclosed buffer overflow flaw in Tenda CH22 firmware version 1.0.0.1 to eliminate the vulnerability.

Security SummaryAI

CVE-2026-5204 is a stack-based buffer overflow vulnerability in the Tenda CH22 router running firmware version 1.0.0.1. The issue resides in the formWebTypeLibrary function within the /goform/webtypelibrary file of the Parameter Handler component, triggered by manipulating the webSiteId argument. This flaw allows remote exploitation and has been publicly disclosed with an available exploit.

An attacker with low privileges, such as an authenticated user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation leads to high impacts on confidentiality, integrity, and availability (CVSS 3.1 score of 8.8), potentially enabling arbitrary code execution, data theft, or denial of service on the affected device.

Advisories from VulDB detail the vulnerability and provide submission links for further reporting, while the manufacturer's site at tenda.com.cn may offer relevant firmware updates or guidance. Additional technical details and a proof-of-concept are available in the referenced GitHub repository.

Details

CWE(s)

Affected Products

tenda
ch22 firmware
1.0.0.1

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The stack-based buffer overflow in the router's public-facing web form handler (/goform/webtypelibrary) directly enables remote exploitation of a public-facing application for arbitrary code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References