CVE-2026-86152

CVE-2026-86152 is a critical (CVSS 4.0: 10) OS command injection flaw in Tenda CP3 camera firmware version 27.5.57.101, located in the CAutoAddWifi::ThreadProc function of Functions/AutoAddWifi.cpp within the camera's Kylin component. A manipulation of input handled by this auto-add-WiFi function allows attacker-controlled commands to be executed on the device, and the attack can be launched remotely; the CVSS vector indicates no privileges, no user interaction, and no elevated attack complexity are required, with high impact on confidentiality, integrity, and availability. A successful exploit effectively yields full compromise of the camera, letting an attacker read, modify, or destroy data and take control of the device. Users operating Tenda CP3 cameras on the affected firmware are exposed, particularly units whose network services are reachable from beyond the local network. As of the latest data there is no public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS assigns only a 1.9% probability of exploitation within 30 days, so exploitation has not been confirmed in the wild.

What to do: Check your CP3 camera's current firmware version and apply a firmware update from Tenda as soon as a patched release is published (no fixed version is specified in the available data, so monitor Tenda advisories). Until patching is possible, reduce exposure by keeping the camera behind a firewall, removing or limiting WAN-facing port forwarding, and placing IoT devices on a segmented network. Since the flaw sits in the auto-add-WiFi (Kylin) functionality, pay attention to vendor guidance on that feature when re-provisioning or setting up cameras.