CVE-2026-5152: Stack-based Buffer Overflow in Tenda CH22
CVE-2026-5152 is a high-severity stack-based buffer overflow vulnerability in Tenda CH22 version 1. 0. 0. 1. It affects the function formCreateFileName in the /goform/createFileName file, where manipulation of the fileNameMit argument can trigger the overflow. The vulnerability can be exploited remotely without user interaction. Although the exploit code is publicly available, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently provided by the vendor.
AI Analysis
Technical Summary
This vulnerability in Tenda CH22 1.0.0.1 involves a stack-based buffer overflow in the formCreateFileName function located in /goform/createFileName. An attacker can remotely manipulate the fileNameMit argument to cause the overflow, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 score is 8.7, reflecting high impact and ease of exploitation without user interaction or privileges. The exploit is publicly known, but no vendor patch or official fix is documented.
Potential Impact
Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. Given the high CVSS score and the nature of stack-based buffer overflows, the impact is significant for the confidentiality, integrity, and availability of the device. However, no confirmed active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting remote access to the affected device and monitor for unusual behavior. Avoid exposing the device's management interface to untrusted networks. Follow vendor channels for updates on patches or mitigations.
CVE-2026-5152: Stack-based Buffer Overflow in Tenda CH22
Description
CVE-2026-5152 is a high-severity stack-based buffer overflow vulnerability in Tenda CH22 version 1. 0. 0. 1. It affects the function formCreateFileName in the /goform/createFileName file, where manipulation of the fileNameMit argument can trigger the overflow. The vulnerability can be exploited remotely without user interaction. Although the exploit code is publicly available, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently provided by the vendor.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Tenda CH22 1.0.0.1 involves a stack-based buffer overflow in the formCreateFileName function located in /goform/createFileName. An attacker can remotely manipulate the fileNameMit argument to cause the overflow, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 score is 8.7, reflecting high impact and ease of exploitation without user interaction or privileges. The exploit is publicly known, but no vendor patch or official fix is documented.
Potential Impact
Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. Given the high CVSS score and the nature of stack-based buffer overflows, the impact is significant for the confidentiality, integrity, and availability of the device. However, no confirmed active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting remote access to the affected device and monitor for unusual behavior. Avoid exposing the device's management interface to untrusted networks. Follow vendor channels for updates on patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-03-30T13:33:02.568Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 69cae2bce6bfc5ba1d6c3e51
Added to database: 3/30/2026, 8:53:16 PM
Last enriched: 4/7/2026, 10:51:45 AM
Last updated: 5/14/2026, 11:58:28 PM
Views: 80
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.