Vulnerability · Published Jul 13, 2026 · Assigned by VulDB
CVE-2026-15543Tenda CH22 CertListInfo formCertListInfo buffer overflow
High 8.8
In plain English
A high-severity buffer overflow in CH22 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.9%top 41.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in Tenda CH22 1.0.0.1. This impacts the function formCertListInfo of the file /goform/CertListInfo. The manipulation of the argument Name results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
Affected products (as reported)
Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-377893 | Tenda CH22 CertListInfo formCertListInfo buffer overflow vdb-entry, technical-description
- VDB-377893 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-15543 | CVE Analysis and Report third-party-advisory
- Submit #855077 | Tenda CH22 V1.0.0.1 Buffer Overflow third-party-advisory
- https://candle-throne-f75.notion.site/Tenda-CH22-formCertListInfo-377df0aa11858088aabaeb0f5e1909c9 exploit
- https://www.tenda.com.cn/ product