This vulnerability affects the Tenda CH22 device firmware versions 1.0.0.1 and 1.If. The issue is a stack-based buffer overflow caused by improper manipulation of the 'funcname' argument in the fromSetCfm function of the /goform/setcfm parameter handler component. The flaw allows remote attackers to trigger a buffer overflow remotely, potentially leading to arbitrary code execution. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed but no patch or vendor advisory is currently available.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code on affected Tenda CH22 devices without requiring user interaction or privileges. This could lead to full compromise of the device, impacting confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interfaces to trusted sources only and monitor for any suspicious activity related to /goform/setcfm requests.