CVE-2026-86148

CVE-2026-86148 is an operating system command injection flaw (CWE-77/CWE-78) in the SystemAsh function of the file Apis/system.c, part of the Kylin component of the Tenda CP3 camera running firmware 27.5.57.101. It is triggered remotely when the AlarmVoiceURL argument is manipulated with crafted input, causing attacker-controlled commands to be executed in the device's OS. The CVSS 4.0 vector indicates high privileges are required (PR:H), meaning an attacker first needs administrative-level access to the device, but successful exploitation yields high impact to confidentiality, integrity, and availability of the camera and potentially subsequent systems. Any deployment of the Tenda CP3 on the affected firmware is exposed, particularly units whose management interface is reachable from the internet. As of this writing there is no public proof of concept, the flaw is not in CISA's KEV, and EPSS assigns a roughly 2.5% probability of exploitation within 30 days.

What to do: Check your CP3 firmware version against 27.5.57.101 and watch Tenda's advisories for a patched release; no fixed version number is provided in the available data. Until updated firmware is available, avoid exposing the camera's management interface directly to the internet and protect administrative credentials, since exploitation requires high-privileged access. Monitor vendor communications for an update addressing the AlarmVoiceURL command injection.