A critical stack-based buffer overflow vulnerability in the Tenda CH22 router, discovered in version 1.0.0.1, poses a significant risk of remote code execution.

The vulnerability exists within the formWebTypeLibrary function of the /goform/webtypelibrary endpoint, where the webSiteId parameter is processed by an unsafe strcat call without length verification. This flaw allows a remote, authenticated attacker to trigger a stack-based buffer overflow, leading to potential denial of service or remote code execution.

Successful exploitation of this vulnerability could grant an attacker full control over the affected network device. Given the CVSS score of 8.8, this represents a high-severity threat that could lead to unauthorized network access, interception of sensitive traffic, and total compromise of the internal gateway.

Immediate Action: Since a specific patch version is not currently listed, administrators should restrict access to the device management interface to trusted internal segments only. Contact Tenda support or monitor the official vendor portal for firmware updates addressing this memory corruption flaw.

Proactive Monitoring: Review system logs for unusual HTTP POST requests directed at /goform/webtypelibrary and monitor for unexpected device reboots or service crashes.

Compensating Controls: Implement an access control list (ACL) on the router to block external access to the web-based management interface, ensuring only authorized administrative workstations can reach the management service.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the research write-up by Li Tengzheng.

Given the exposure of the administrative interface and the presence of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently using Tenda CH22 devices in version 1.0.0.1 must prioritize isolating these devices from the public internet and applying forthcoming firmware updates as soon as they are made available by the vendor.