The Tenda CH22 device running firmware version 1.0.0.1 contains a command injection vulnerability (CVE-2026-78141) in the formexeCommand function of the /goform/exeCommand endpoint. An attacker with low privileges can remotely manipulate the cmdinput parameter to execute arbitrary commands on the device. This vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The CVSS 3.1 score is 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and partial impact on confidentiality, integrity, and availability. Public disclosure of the exploit exists, but no active exploitation has been reported. No vendor patch or mitigation details are currently provided.

Successful exploitation allows remote attackers with low privileges to execute arbitrary commands on the affected device, potentially leading to partial compromise of confidentiality, integrity, and availability. The vulnerability affects the device's command execution functionality, which could be leveraged to disrupt operations or extract sensitive information. The CVSS score of 7.4 indicates a high severity impact, but no active exploitation in the wild has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to the affected endpoint and monitor for suspicious activity related to command execution attempts. Avoid exposing the device's management interfaces to untrusted networks.