CVE-2026-5604
Published: 05 April 2026
Summary
CVE-2026-5604 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ch22 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-5604 is a stack-based buffer overflow vulnerability affecting the Tenda CH22 router running firmware version 1.0.0.1. The flaw resides in the formCertLocalPrecreate function within the /goform/CertLocalPrecreate file of the Parameter Handler component, triggered by manipulation of the "standard" argument. This issue, linked to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-04-05.
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation leads to high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution on the affected device.
Advisories from VulDB detail the vulnerability and reference a publicly released exploit on GitHub at https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_52/README.md. No specific patches are mentioned in the available information; security practitioners should consult the Tenda website at https://www.tenda.com.cn/ for firmware updates or mitigation guidance.
The exploit's public availability increases the risk of real-world attacks against unpatched Tenda CH22 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19138
Vulnerability details
A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formCertLocalPrecreate of the file /goform/CertLocalPrecreate of the component Parameter Handler. Performing a manipulation of the argument standard results in stack-based buffer overflow. Remote exploitation…
more
of the attack is possible. The exploit has been released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in router web form handler (/goform/CertLocalPrecreate) enables remote exploitation of public-facing application with low-priv access and arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents stack-based buffer overflows by validating inputs such as the 'standard' argument in the formCertLocalPrecreate function.
Ensures timely identification, reporting, and patching of the specific buffer overflow flaw in Tenda CH22 firmware version 1.0.0.1.
Implements memory safeguards like stack canaries or DEP to block arbitrary code execution from stack buffer overflows even if input validation fails.