This vulnerability involves a stack-based buffer overflow in Tenda CH22 firmware version 1.0.0.1, specifically in the formCertLocalPrecreate function of the /goform/CertLocalPrecreate endpoint. By manipulating the 'standard' argument, an attacker can cause a buffer overflow on the stack, which may lead to remote code execution or denial of service. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. The CVSS 4.0 score of 8.7 reflects high impact on confidentiality, integrity, and availability. Although an exploit is publicly available, no official patch or vendor advisory has been published to date.

Successful exploitation can lead to remote code execution or denial of service on affected Tenda CH22 devices running version 1.0.0.1. The vulnerability compromises confidentiality, integrity, and availability of the device. Since the exploit is publicly available, there is an increased risk of active attacks. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, affected users should consider disabling or restricting access to the vulnerable endpoint if possible, or isolate the device from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.