CVE-2026-5204
Published: 31 March 2026
Summary
CVE-2026-5204 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ch22 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-5204 is a stack-based buffer overflow vulnerability in the Tenda CH22 router running firmware version 1.0.0.1. The issue resides in the formWebTypeLibrary function within the /goform/webtypelibrary file of the Parameter Handler component, triggered by manipulating the webSiteId argument. This flaw allows remote exploitation and has been publicly disclosed with an available exploit.
An attacker with low privileges, such as an authenticated user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation leads to high impacts on confidentiality, integrity, and availability (CVSS 3.1 score of 8.8), potentially enabling arbitrary code execution, data theft, or denial of service on the affected device.
Advisories from VulDB detail the vulnerability and provide submission links for further reporting, while the manufacturer's site at tenda.com.cn may offer relevant firmware updates or guidance. Additional technical details and a proof-of-concept are available in the referenced GitHub repository.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17509
Vulnerability details
A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack can be initiated remotely. The exploit…
more
has been publicly disclosed and may be utilized.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack-based buffer overflow in the router's public-facing web form handler (/goform/webtypelibrary) directly enables remote exploitation of a public-facing application for arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the webSiteId parameter input to the formWebTypeLibrary function, directly preventing the stack-based buffer overflow from malicious manipulation.
Implements memory protections such as stack canaries and address space layout randomization to mitigate exploitation of the stack-based buffer overflow even if invalid input is processed.
Mandates timely identification, reporting, and patching of the publicly disclosed buffer overflow flaw in Tenda CH22 firmware version 1.0.0.1 to eliminate the vulnerability.