This vulnerability in Tenda CH22 1.0.0.1 involves a buffer overflow triggered by improper handling of the Name argument in the formCertListInfo function located in /goform/CertListInfo. The flaw allows remote attackers to cause a buffer overflow condition, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Although an exploit is publicly available, there is no vendor-provided patch or official remediation at this time.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected device. The attacker can trigger the buffer overflow remotely by manipulating the Name argument in the vulnerable function. This poses a significant risk to the confidentiality, integrity, and availability of the device and its network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the affected device and monitoring for exploit attempts. No official patch or workaround has been provided by the vendor as of now.