CVE-2026-77031 in CH22
Summary
by MITRE • 08/20/2026
A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The Tenda CH22 router, specifically version 1.0.0.1, contains a critical security flaw within its web management interface that allows for remote command injection. This vulnerability resides in the formcreateFileName function located at the /goform/formcreateFileName endpoint. The root cause of this issue is an insufficient validation and sanitization mechanism applied to the fileNameMit argument before it is processed by underlying system commands. When a user or attacker submits data through this specific form field, the application fails to properly escape special characters that have meaning in shell environments. This lack of input filtering allows malicious actors to inject arbitrary operating system commands directly into the execution context of the router's firmware.
From an operational perspective, this vulnerability is particularly severe because it can be exploited remotely without requiring any prior authentication or user interaction beyond accessing the web interface. An attacker who has network access to the device can send crafted HTTP requests containing malicious payloads in the fileNameMit parameter. Upon processing these requests by the vulnerable function, the injected commands are executed with the privileges of the underlying service, which typically runs as root on embedded Linux devices like routers. This capability effectively grants the attacker full control over the compromised system, enabling them to read sensitive configuration files, install persistent backdoors, pivot into internal networks, or use the device as part of a larger botnet infrastructure for distributed denial-of-service attacks.
The technical nature of this flaw aligns with CWE-78, which defines Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The failure to sanitize user-supplied input before its use in system calls is a classic example of this category of vulnerability. Furthermore, the exploitation technique maps directly to MITRE ATT&CK techniques related to command and script interpretation, specifically those involving remote code execution via web applications. The fact that public exploits have been disclosed indicates that automated scanning tools and threat actors are likely actively targeting devices running this specific firmware version, increasing the urgency for remediation.
Mitigation strategies must prioritize immediate patching if a vendor-provided update is available to address the input validation logic in the formcreateFileName function. In cases where an official patch is not yet released or cannot be applied immediately, network-level controls should be implemented to restrict access to the router's management interface. This includes disabling remote administration features and ensuring that the web GUI is only accessible from trusted internal networks rather than exposed directly to the internet. Additionally, implementing strict firewall rules to limit inbound traffic on ports associated with the device's HTTP services can reduce the attack surface. Regular firmware audits and monitoring for unusual outbound network connections are also recommended to detect potential compromise early in the lifecycle of such vulnerabilities.