Remote Command Injection in Tenda CH22

Tenda CH22 devices running firmware version 1.0.0.1 contain a critical command injection vulnerability identified as CVE-2026-19346. The flaw resides within the formCertListInfo function located in the /goform/CertListInfo file. An unauthenticated remote attacker can exploit this vulnerability by sending a maliciously crafted HTTP request containing specially formatted input in the 'Name' argument. Successful exploitation results in the execution of arbitrary system commands with the privileges of the web service process. Given the public availability of exploit information, there is a risk of active exploitation by opportunistic actors. Organizations using Tenda CH22 hardware must ensure the device is segmented from public-facing networks or updated if a patch is provided by the vendor.

Impact

The vulnerability allows unauthenticated remote attackers to gain command execution on the target device. This can lead to full system compromise, persistent access, and the potential inclusion of the device in botnets used for further malicious activity or network reconnaissance.

Recommendation

• Monitor web server logs for HTTP requests directed at /goform/CertListInfo containing shell metacharacters such as backticks, semicolons, or pipe symbols in the 'Name' parameter.
• Implement network-level access control lists to restrict management interface access to trusted administrative subnets.
• Check for vendor security advisories and firmware updates for Tenda CH22 units; apply updates immediately to remediate CVE-2026-19346.