CVE-2026-5155: Stack Overflow in Tenda CH22 Router

The stack-based buffer overflow vulnerability in the Tenda CH22 router allows a remote attacker to potentially gain control of the device. By crafting a malicious request that manipulates the wanmode parameter within the /goform/AdvSetWan endpoint, an attacker can overwrite memory on the stack. This can lead to arbitrary code execution, allowing the attacker to install malware, steal sensitive data (such as router configuration and user credentials), or disrupt network services. The public availability of an exploit significantly increases the risk of exploitation.

1. Reserved2026-03-30
2. Published2026-03-30
3. Modified2026-04-02
4. EPSS updated2026-04-07

Due to the lack of a publicly available patch, immediate mitigation strategies are crucial. Consider isolating the affected Tenda CH22 routers from the internet by placing them behind a firewall with strict access control rules. Implement a Web Application Firewall (WAF) to filter malicious requests targeting the /goform/AdvSetWan endpoint. Monitor router logs for unusual activity, particularly requests containing suspicious wanmode values. Once a firmware update is released by Tenda, apply it immediately. After upgrade, confirm functionality by accessing the router's web interface and verifying the WAN configuration.