The CVSS 7.4 rating for this vulnerability is a dangerous misclassification. Unauthenticated remote command injection on a networked IoT device isn't a 'high' severity issue in practice — it's effectively game over for that device and everything on its network segment. An attacker with no credentials, no authentication tokens, and no prior access gets direct shell access to the device's Linux operating system. The CVSS model weights 'low attack complexity' and 'none required privileges' as vector components, but for IoT devices this is the threat model itself. There's no meaningful separation between the web process and the underlying OS because the development workflow for consumer-grade SOHO equipment assumes the network boundary is the only perimeter — everything inside is treated as a trusted debugging environment. That assumption shipped.
The presence of a 'formexeCommand' function in production firmware isn't debug code that leaked into shipping builds. It's the product's actual interface philosophy. SOHO device development happens under extreme cost and time pressure with constrained toolchains. The command execution entry point that makes firmware development tractable becomes the production interface because there was never a meaningful differentiation between 'how we build this' and 'how users access this.' The /goform/ path structure persisting across Tenda models isn't evidence of copy-paste failures — it's evidence of a development methodology where the debugging infrastructure IS the product, and shipping it is the path of least resistance.
The blast radius of this single vulnerability extends far beyond the device itself. That SOHO router is simultaneously the DNS resolver, DHCP server, NAT gateway, and often the VPN endpoint for everything behind it. Compromising it doesn't give you one device — it gives you a man-in-the-middle position on every subsequent connection from every device on that network segment. CVSS measures 'confidentiality and availability impact on the vulnerable component' but has no vocabulary for pivot potential.
This isn't an isolated incident. CVE-2019-13134, CVE-2022-30007, and CVE-2023-32156 all targeted Tenda devices, all used the /goform/ path, all involved command injection in devices sharing codebases. Each got its own CVE, its own score, its own version-specific patch. None addressed the architectural decision that keeps producing the same vulnerability. The genealogy across years and models reveals a genetic defect being passed down because the lineage was never surgically examined. Treating each instance as an isolated coding error normalizes continued deployment of devices with a documented architectural vulnerability.
The remediation timeline compounds the problem. Tenda's documented support lifecycle for consumer SOHO gear is effectively 'until next model ships.' A vendor receiving a CVE report for one model has no obligation to audit whether the same vulnerable function exists in other current-production models sharing the same codebase. They patch the reported version, issue an advisory, and move on. CH22 gets patched; CH20 or CH10 sharing the /goform/ code path may not even be notified. Each prior CVE created a disclosure-to-fix lag, and each lag left a cohort of devices in a disclosed-but-unfixed state. This CVE doesn't enter a landscape of previously remediated vulnerabilities — it enters a landscape where three prior vulnerabilities were disclosed, patched on paper, and almost certainly not remediated in the field.
What you should do: First, verify whether the public exploit requires authentication or if this is a true zero-click remote vector against default configurations — this fundamentally changes the risk profile. Second, treat any Tenda device with the /goform/ path structure as presumptively vulnerable until proven otherwise, regardless of model number. Third, assume the architectural vulnerability persists across firmware versions even after patching, because version-specific patches don't address the underlying design decision. Fourth, prioritize network segmentation — treat every SOHO router behind your perimeter as an attacker pivot point rather than a trusted device. Fifth, for any Tenda device you manage, assume it's already compromised through a prior iteration of this vulnerability class if it's been online since 2019.