A critical memory corruption vulnerability in the Tenda CH22 router firmware could allow remote attackers to execute arbitrary code or cause a system crash.

This is a buffer overflow vulnerability (CWE-120) located in the fromPptpUserSetting function within the /goform/PPTPUserSetting endpoint. Attackers with low-level privileges can trigger this flaw by manipulating the delno argument, leading to potential remote code execution.

The vulnerability carries a CVSS score of 8.8, indicating a high level of risk to operational integrity. A successful exploit could lead to full system compromise of the affected network device, enabling attackers to gain unauthorized access to internal network traffic or disrupt critical communication services, resulting in significant downtime and potential data exfiltration.

Immediate Action: Since no official patch is currently confirmed, users should restrict access to the device management interface to trusted internal segments only and disable the PPTP functionality if it is not strictly required for operations.

Proactive Monitoring: Monitor network traffic for unusual requests directed at the /goform/PPTPUserSetting endpoint and review device system logs for signs of unexpected crashes or reboots associated with unauthorized input.

Compensating Controls: Deploy a Web Application Firewall or an intrusion detection system capable of filtering malformed inputs to the administrative web interface to mitigate the risk of exploitation.

Public Exploit Available: Yes — a published proof-of-concept exists on GitHub as referenced in the vulnerability disclosure.

Given the remote exploitability and the existence of a public proof-of-concept, users must treat this vulnerability with high priority. Administrators should immediately isolate the affected Tenda CH22 devices from public-facing networks and monitor for vendor-provided firmware updates that address this memory corruption flaw.