CVE-2026-5152 describes a high-severity stack-based buffer overflow (CVSS 8.8) in Tenda CH22 1.0.0.1. This vulnerability, located in the formCreateFileName function, allows a remote attacker with low privileges to achieve high impact on confidentiality, integrity, and availability by manipulating the fileNameMit argument. The attack complexity is low, and no user interaction is required. Although not currently in CISA's KEV catalog, exploit code for this vulnerability is publicly available, indicating an elevated and immediate risk. Community discussion shows growing awareness of this issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0.0.1CPE matchmatch criteria | cpe:2.3:o:tenda:ch22_firmware:1.0.0.1:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.