Remote Command Injection in Tenda CH22 Firmware

A critical command injection vulnerability exists in Tenda CH22 firmware version 1.0.0.1, specifically within the function 'formeditFileName' located in the file '/goform/editFileName'. The vulnerability is triggered by the improper sanitization of the 'editNameMit' parameter, allowing an attacker to inject and execute arbitrary system commands. This flaw is remotely exploitable and proof-of-concept exploit code has been publicly released, increasing the risk of exploitation by threat actors. Given the nature of the device as a network routing component, successful exploitation provides an attacker with a persistent foothold, potential for traffic interception, and capability for lateral movement within the local network.

Attack Chain

1. Attacker performs network reconnaissance to identify reachable Tenda CH22 devices via the public internet.
2. Attacker crafts a malicious HTTP POST request targeting the endpoint '/goform/editFileName'.
3. The request includes a payload within the 'editNameMit' parameter containing shell metacharacters (e.g., ;, |, &&).
4. The web server process of the Tenda firmware fails to sanitize the input before passing it to a system-level function.
5. The underlying operating system executes the injected command with the privileges of the web service process.
6. Attacker initiates a reverse shell connection or downloads additional post-exploitation tooling to maintain access.
7. Final objective achieved: unauthorized administrative control over the network device.

Impact

Successful exploitation of this vulnerability results in full remote command execution on the target router. This allows an attacker to manipulate network traffic, bypass firewall rules, pivot to internal resources, or add the device to a botnet. As this is a networking appliance, the impact extends to all devices communicating through the compromised router.

Recommendation

Prioritized, concrete actions for detection engineering and security teams:

• Identify and inventory all Tenda CH22 devices within the environment to assess exposure.
• Apply network segmentation to isolate these devices from the public internet.
• Monitor web traffic logs for HTTP POST requests targeting the '/goform/editFileName' URI.
• Implement the provided Sigma rule to detect exploitation attempts targeting the 'editNameMit' parameter.
• Check the Tenda support website for firmware updates addressing CVE-2026-78063 and patch all affected instances immediately.