CVE-2026-15543 is a remote buffer overflow vulnerability affecting Tenda CH22 version 1.0.0.1. The flaw occurs in the formCertListInfo function of the /goform/CertListInfo file, where improper handling of the Name argument allows an attacker to overflow a buffer. This can be exploited remotely without user interaction and requires low privileges. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high impact on confidentiality, integrity, and availability. Although an exploit is publicly available, no official patch or remediation level has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability can lead to a buffer overflow condition, potentially allowing an attacker to execute arbitrary code remotely, disrupt service, or compromise device integrity. The CVSS vector indicates high impact on confidentiality, integrity, and availability, with no required user interaction and low attack complexity. The vulnerability affects the Tenda CH22 device running version 1.0.0.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided, users should monitor Tenda's official channels for updates. Until a patch is available, restricting network access to the vulnerable endpoint and applying network-level protections may reduce exposure.