Tenda CH22 V1.0.0.1 DHCP LISTLEN Unvalidated Input Denial of Service

Critical Vulnerability Information Vulnerability Title Tenda CH22 V1.0.0.1 Denial of Service Vulnerability Description This vulnerability exists in the function of the CH22 V1.0.0.1 firmware, which handles DHCP static IP configuration. The application retrieves the value of the parameter from the HTTP request and converts it to an integer using to determine the number of loop iterations. The code logic is approximately: . However, the parameter lacks upper-bound validation. Inside the loop, the application performs resource-intensive operations, including string formatting ( ), parameter retrieval ( ), and writing to NVRAM ( ). An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP POST request with set to an extremely large value (e.g., "1000000"). This forces the device to execute millions of iterations, resulting in 100% CPU usage and exhaustion of system resources. This causes the web server (httpd) to become unresponsive and typically triggers a system watchdog reboot, leading to a denial of service. Source https://github.com/master-abc/cve/issues/7 Submitter jiefengliang (UID 93721) Submission Time 2025-12-28 04:49 PM Review Time 2025-12-29 08:50 AM Status Accepted VulDB Entry 338025 [Tenda CH22 up to 1.0.0.1 /goform/DhcpListClient fromDhcpListClient LISTLEN denial of service] Score 20

Goal Reached Thanks to every supporter — we hit 100%!

Tenda CH22 V1.0.0.1 DHCP LISTLEN Unvalidated Input Denial of Service