OS Command Injection Vulnerability in Tenda CP3 by Tenda
CVE-2026-86148

9.4CRITICAL

Key Information:

Vendor

Tenda
Status
Cp3
Vendor
CVE Published:
5 September 2026

What is CVE-2026-86148?

A security flaw has been identified in Tenda CP3 v27.5.57.101, whereby the SystemAsh function in the Apis/system.c component is susceptible to OS command injection. This vulnerability arises from improper handling of the AlarmVoiceURL argument, allowing an attacker to execute arbitrary commands on the system remotely. Prompt action should be taken to mitigate the risks associated with this exposure.

Affected Version(s)

CP3 27.5.57.101

References

https://vuldb.com/vuln/399271
vdb-entrytechnical-description
https://vuldb.com/vuln/399271/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-86148
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

FengZi (VulDB User)
VulDB Vulnerability Moderation Team
.