CVE-2026-78141

Received Received - Intake

Command Injection in Tenda CH22 Router

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: VulDB

Description

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-23

Last Modified

2026-08-23

Generated

2026-08-24

AI Q&A

2026-08-24

EPSS Evaluated

N/A

NVD

CVE-2026-78141

EUVD

EUVD-2026-64666

Affected Vendors & Products

Vendor	Product	Version / Range
tenda	ch22	1.0.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw in Tenda CH22 version 1.0.0.1. It exists in the formexeCommand function of the file /goform/exeCommand where the cmdinput argument can be manipulated to execute arbitrary commands. The attack can be performed remotely without requiring authentication.

Detection Guidance

To detect this vulnerability, scan your network for devices running Tenda CH22 firmware version 1.0.0.1. Check if the device exposes the /goform/exeCommand endpoint. Test for command injection by sending crafted inputs to the cmdinput parameter in the formexeCommand function.

Impact Analysis

An attacker could exploit this to run unauthorized commands on the affected device, potentially gaining control over it. This may lead to data theft, device misuse, or further network compromise depending on the device's role and network configuration.

Compliance Impact

This vulnerability, a command injection flaw in Tenda CH22, could potentially allow unauthorized remote execution of commands. This may lead to unauthorized access to sensitive data, which could violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized command execution might enable data breaches or unauthorized modifications, posing significant compliance risks.

Mitigation Strategies

Immediately update the Tenda CH22 firmware to the latest version to patch the command injection vulnerability in the /goform/exeCommand endpoint. Disable remote access to the device if not required and restrict network access to trusted sources only.

Hi! I’m here to help you understand CVE-2026-78141. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70