CVE-2026-77031 rates CVSS 7.4 (High) for a pre-authentication command injection in Tenda CH22 firmware's /goform/formcreateFileName handler. That score substantially understates the actual risk, and here's why it matters for your defensive posture.
Command injection on a network edge device is not equivalent to command injection on a general-purpose server. When an attacker achieves code execution on a Tenda router positioned at the network perimeter, they don't just own the device—they own the traffic chokepoint for everything behind it. DNS redirection, SSL stripping, credential harvesting from plaintext flows, and lateral movement become immediate post-exploitation capabilities, not secondary exploits. The blast radius is categorical, not quantitative, and this is precisely what CVSS cannot model: it weights impact as a property of the vulnerable component rather than the component's position in network topology.
The pre-authentication nature compounds this. These consumer devices ship without meaningful authentication, session management, or role-based access controls—the concept of 'pre-auth' is hollow when there's nothing to authenticate against. The CVSS exploitability subscore treats authentication as a meaningful barrier, which produces artificially conservative numbers for embedded devices.
The '2026' date in this CVE identifier is anomalous and suggests metadata reliability issues, but the core vulnerability is well-documented: Tenda's /goform/ endpoints represent a known vulnerability class with multiple CVE entries across years, all consistently scoring in the 7-8 range while functioning as critical in practice. The parameter name 'fileNameMit' itself appears to be a failed mitigation attempt—evidence that someone attempted sanitization but left the underlying command injection class intact.
For defenders: treat the CVSS score as noise and the vulnerability class as signal. Segment Tenda edge devices from sensitive network segments, monitor for the /goform/ endpoint activity patterns that precede exploitation, and plan for replacement rather than remediation—consumer IoT devices at end-of-life rarely receive patches, and the exposure window is effectively permanent.