CVE-2026-86151

Tenda CP3 firmware version 27.5.57.101 contains an OS command injection flaw (CWE-77/CWE-78) in the Network Configuration Management component, located in the function sub_2F77E8 of the file Apis/system.c. By remotely manipulating input handled by this function, an attacker can have arbitrary operating-system commands executed on the device. The CVSS 4.0 vector shows the attack is network-based, requires no user interaction and low attack complexity, but does require high privileges — meaning the attacker must already hold an authenticated, privileged session — with high impact on confidentiality, integrity and availability, effectively permitting full device compromise. Owners of Tenda CP3 devices running the affected firmware are in scope. Exploitation has not been confirmed: the flaw is not in CISA's KEV, no public proof-of-concept is known, and EPSS currently estimates only about a 2% chance of exploitation within 30 days (80th percentile).

What to do: Check your CP3's current firmware version and, when Tenda publishes a patched release, upgrade promptly (no fixed version is confirmed in the available data, so monitor Tenda's support/advisory channels). Until patched, reduce exposure by disabling direct port forwarding or UPnP exposure for the camera and restricting remote access to trusted networks or the vendor's cloud app. Devices running firmware 27.5.57.101 should be treated as affected.