CH22 1.0.0.1 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ch22-1.0.0.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 13 Jul 2026 08:17:56 +0000Critical Buffer Overflow in Tenda CH22 Leads to Remote Code Execution (CVE-2026-15543)https://feed.craftedsignal.io/briefs/2026-07-cve-2026-15543-tenda-rce/Mon, 13 Jul 2026 08:17:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-15543-tenda-rce/A critical buffer overflow vulnerability, CVE-2026-15543, exists in the Tenda CH22 1.0.0.1 firmware's `formCertListInfo` function, allowing unauthenticated remote attackers to achieve arbitrary code execution by manipulating the 'Name' argument, with a public exploit available.A severe buffer overflow vulnerability, identified as CVE-2026-15543, has been discovered in the firmware of Tenda CH22 1.0.0.1 devices. This flaw specifically impacts the formCertListInfo function located within the /goform/CertListInfo file. By crafting a malicious input to the 'Name' argument, a remote attacker can trigger a buffer overflow, which can lead to arbitrary code execution on the vulnerable device. This vulnerability does not require authentication and can be exploited remotely, posing a significant risk to affected systems. The existence of a publicly available exploit escalates the urgency for immediate patching, as it significantly lowers the barrier for attackers to compromise these devices. Defenders must prioritize patching to prevent unauthorized control and potential network compromise.

Attack Chain

  1. An unauthenticated remote attacker identifies a Tenda CH22 1.0.0.1 device accessible over the network.
  2. The attacker crafts a specially designed HTTP request targeting the /goform/CertListInfo endpoint on the vulnerable device.
  3. The request includes a malformed or excessively long value in the 'Name' argument, intended to exceed the allocated buffer size.
  4. Upon processing this request, the formCertListInfo function attempts to handle the oversized 'Name' argument, resulting in a buffer overflow.
  5. The buffer overflow corrupts adjacent memory, allowing the attacker to inject and execute arbitrary code on the device.
  6. Successful exploitation grants the attacker full control over the compromised Tenda CH22 device, potentially enabling further network penetration or data exfiltration.

Impact

Successful exploitation of CVE-2026-15543 results in full remote code execution on the affected Tenda CH22 1.0.0.1 device. This allows attackers to gain complete control, potentially altering device configurations, installing malicious firmware, creating backdoors, or using the device as a pivot point for further attacks within the connected network. Given that the vulnerability is remotely exploitable and a public exploit is available, many devices could be at high risk of compromise by a wide range of threat actors. Organizations using Tenda CH22 devices must act swiftly to prevent unauthorized access and potential data breaches or service disruptions.

Recommendation

  • Immediately patch Tenda CH22 devices to a version where CVE-2026-15543 is remediated.
  • Monitor network traffic for unusual connections originating from or destined for Tenda CH22 devices, potentially indicating exploitation attempts for CVE-2026-15543.
  • If patching is not immediately feasible, restrict network access to Tenda CH22 devices from untrusted networks to mitigate remote exploitation attempts for CVE-2026-15543.
]]>criticaladvisorycvevulnerabilitybuffer-overflowremote-code-executionnetwork-device