This vulnerability affects Tenda CH22 version 1.0.0.1 and involves command injection via the editNameMit argument in the formeditFileName function at the /goform/editFileName endpoint. An attacker can remotely exploit this flaw to execute arbitrary commands on the device. The vulnerability is publicly known and exploit code has been released, increasing the risk of attacks. No vendor advisory or patch information is currently available, and the remediation level is unspecified.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected Tenda CH22 device, potentially compromising device integrity and confidentiality. The medium CVSS score reflects moderate impact with network attack vector and low complexity. No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the device management interface and monitor for suspicious activity. No official patch or temporary fix is currently documented.