OS Command Injection Vulnerability in Tenda CP3 by Tenda
CVE-2026-86152

10CRITICAL

Key Information:

Vendor

Tenda
Status
Cp3
Vendor
CVE Published:
6 September 2026

What is CVE-2026-86152?

A security flaw has been identified in the Tenda CP3 device, specifically within the CAutoAddWifi::ThreadProc function located in AutoAddWifi.cpp of the Kylin component. This vulnerability can be exploited remotely to execute arbitrary operating system commands. A successful attack could allow an unauthorized user to manipulate the device, leading to severe security implications.

Affected Version(s)

CP3 27.5.57.101

References

https://vuldb.com/vuln/399275
vdb-entrytechnical-description
https://vuldb.com/vuln/399275/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-86152
third-party-advisory

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

FengZi (VulDB User)
VulDB Vulnerability Moderation Team
.