OS Command Injection in Tenda CP3 by Tenda
CVE-2026-86149

9.4CRITICAL

Key Information:

Vendor

Tenda
Status
Cp3
Vendor
CVE Published:
5 September 2026

What is CVE-2026-86149?

A vulnerability has been discovered in Tenda CP3, specifically in the file Net/NetCheckPing.cpp. This flaw arises from the improper handling of input parameters, which can be exploited remotely to perform OS command injection. Attackers can manipulate the argument interface_name/host, potentially gaining unauthorized access to execute arbitrary commands on the affected system.

Affected Version(s)

CP3 27.5.57.101

References

https://vuldb.com/vuln/399272
vdb-entrytechnical-description
https://vuldb.com/vuln/399272/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-86149
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

FengZi (VulDB User)
VulDB Vulnerability Moderation Team
.