A critical buffer overflow vulnerability in Tenda CH22 firmware enables remote attackers to execute arbitrary code, posing a severe risk to device integrity and network security.

This vulnerability is a buffer overflow (CWE-120) triggered by improper handling of the page argument within the frmL7ImForm function of the /goform/L7Im endpoint. The vulnerability is exploitable by an authenticated user with low privileges, as indicated by the CVSS vector PR:L.

The ability to perform remote code execution allows an attacker to gain unauthorized control over the affected network device. This can lead to total compromise of the hardware, lateral movement into internal network segments, or the permanent disruption of network services, justifying the High severity score of 8.8.

Immediate Action: Contact Tenda support or check the official vendor portal for firmware updates addressing this buffer overflow, as no official patch version is currently verified.

Proactive Monitoring: Monitor network traffic for unusual requests directed at the /goform/L7Im endpoint and review system logs for signs of unauthorized access or service crashes.

Compensating Controls: Implement strict network access control lists to restrict management access to the device and deploy a Web Application Firewall or intrusion prevention system to filter malicious payloads targeting the vulnerable form parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up referenced by the CVE record (https://github.com/maximdevere/CVE2/issues/5#issue-3673676260).

Given the availability of a public proof-of-concept and the high potential for remote code execution, this vulnerability represents a significant threat. Administrators must prioritize isolating the affected CH22 devices from public-facing networks until a vendor-provided firmware update is applied to remediate the underlying memory corruption flaw.