CVE-2026-78063: Command Injection in Tenda CH22

This vulnerability affects Tenda CH22 firmware version 1.0.0.1. It arises from improper input validation in the formeditFileName function at the /goform/editFileName endpoint. Specifically, the editNameMit parameter can be manipulated to perform command injection, enabling remote attackers to execute arbitrary commands on the device. The vulnerability is remotely exploitable without user interaction and has a medium CVSS 4.0 base score of 5.3. Public exploit code has been released, increasing the risk of exploitation. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption of the device's operation. The medium severity score reflects the moderate impact and ease of exploitation due to network accessibility and low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the affected device and monitoring for suspicious activity related to the /goform/editFileName endpoint. Avoid exposing the device to untrusted networks.