CVE-2026-5204
Published: 31 March 2026
Description
A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack can be initiated remotely. The exploit…
more
has been publicly disclosed and may be utilized.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of the webSiteId parameter input to the formWebTypeLibrary function, directly preventing the stack-based buffer overflow from malicious manipulation.
Implements memory protections such as stack canaries and address space layout randomization to mitigate exploitation of the stack-based buffer overflow even if invalid input is processed.
Mandates timely identification, reporting, and patching of the publicly disclosed buffer overflow flaw in Tenda CH22 firmware version 1.0.0.1 to eliminate the vulnerability.
Security SummaryAI
CVE-2026-5204 is a stack-based buffer overflow vulnerability in the Tenda CH22 router running firmware version 1.0.0.1. The issue resides in the formWebTypeLibrary function within the /goform/webtypelibrary file of the Parameter Handler component, triggered by manipulating the webSiteId argument. This flaw allows remote exploitation and has been publicly disclosed with an available exploit.
An attacker with low privileges, such as an authenticated user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation leads to high impacts on confidentiality, integrity, and availability (CVSS 3.1 score of 8.8), potentially enabling arbitrary code execution, data theft, or denial of service on the affected device.
Advisories from VulDB detail the vulnerability and provide submission links for further reporting, while the manufacturer's site at tenda.com.cn may offer relevant firmware updates or guidance. Additional technical details and a proof-of-concept are available in the referenced GitHub repository.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack-based buffer overflow in the router's public-facing web form handler (/goform/webtypelibrary) directly enables remote exploitation of a public-facing application for arbitrary code execution.