CVE-2026-5204

Name of the Vulnerable Software and Affected Versions Tenda CH22 version 1.0.0.1

Description A flaw exists in the Parameter Handler component of the Tenda CH22. Specifically, the formWebTypeLibrary function within the /goform/webtypelibrary file is susceptible to a stack-based buffer overflow. This occurs due to manipulation of the webSiteId argument. The attack can be initiated remotely and has been publicly disclosed.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /goform/webtypelibrary file.