This vulnerability exists in Tenda CH22 version 1.0.0.1 within the formexeCommand function of the /goform/exeCommand endpoint. An attacker can manipulate the cmdinput parameter to perform command injection remotely. The vulnerability has been publicly disclosed, but there is no vendor advisory or patch information available at this time. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption of the device. The impact is rated medium based on the CVSS score of 5.3. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation is currently documented, users should monitor vendor communications for updates. Until a patch is available, restricting network access to the affected device and disabling remote management interfaces where possible may reduce exposure.