PT-2026-29131 · Tenda · Ch22

Ltzhuster · Published 2026-03-30 · Updated 2026-03-30 · CVE-2026-5153

NVD

CVSS v2.0

6.5

Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

A flaw has been found in Tenda CH22 1.0.0.1. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. Executing a manipulation of the argument mac can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-5153

Affected Products

Ch22

References · 6

• 🔥 https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_60/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5153 · Security Note
• https://vuldb.com/vuln/354185 · Note
• https://vuldb.com/submit/780204 · Note
• https://vuldb.com/vuln/354185/cti · Note
• https://tenda.com.cn · Note