CVE-2026-86152: Tenda CP3 OS Command Injection Vulnerability

CVE-2026-86152 Overview

CVE-2026-86152 is an OS command injection vulnerability affecting Tenda CP3 firmware version 27.5.57.101. The flaw resides in the CAutoAddWifi::ThreadProc function within Functions/AutoAddWifi.cpp, part of the Kylin component. Attackers can exploit this issue remotely over the network without authentication or user interaction. Successful exploitation permits arbitrary operating system command execution on the affected device, compromising confidentiality, integrity, and availability. The vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
Unauthenticated remote attackers can execute arbitrary operating system commands on affected Tenda CP3 devices, leading to full device compromise.

Affected Products

Tenda CP3 firmware version 27.5.57.101
Kylin component (Functions/AutoAddWifi.cpp)
CAutoAddWifi::ThreadProc function

Discovery Timeline

2026-09-06 - CVE-2026-86152 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86152

Vulnerability Analysis

The vulnerability affects the CAutoAddWifi::ThreadProc function in the Tenda CP3 IP camera firmware. This function belongs to the Kylin component responsible for automated Wi-Fi provisioning. The function processes input data and passes it to a system-level command interpreter without sufficient neutralization of shell metacharacters. Attackers who reach the vulnerable code path can inject additional shell commands that execute with the privileges of the calling process. Because the affected function runs as part of the device's core services, successful exploitation typically results in root-level command execution.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The CAutoAddWifi::ThreadProc routine constructs command strings using attacker-influenced input without escaping or validating shell metacharacters such as ;, |, &, and backticks. This construction pattern permits command separators to break out of the intended command context.

Attack Vector

The vulnerability is exploitable remotely across a network with no authentication or user interaction required. An attacker who can reach the Wi-Fi provisioning service on an exposed Tenda CP3 device can send crafted input that reaches the CAutoAddWifi::ThreadProc function. The injected commands then execute on the underlying operating system. The EPSS score of 1.859% (77th percentile) indicates elevated exploitation likelihood relative to the broader CVE population. No verified public proof-of-concept code has been published in the referenced advisories. See the VulDB entry for CVE-2026-86152 for additional technical context.

Detection Methods for CVE-2026-86152

Indicators of Compromise

Unexpected child processes spawned by the Tenda CP3 firmware services, particularly shell interpreters invoked from the Kylin/AutoAddWifi context.
Anomalous outbound network connections from CP3 devices to attacker infrastructure.
Unauthorized modification of device configuration, firmware components, or credential stores.
Presence of new user accounts, cron entries, or startup scripts on the device filesystem.

Detection Strategies

Monitor network traffic to Tenda CP3 devices for malformed Wi-Fi provisioning requests targeting the auto-add-Wi-Fi service.
Inspect ingress traffic for shell metacharacters (;, |, &&, backticks) within HTTP or proprietary protocol payloads directed at CP3 endpoints.
Baseline expected outbound behavior of IP cameras and alert on deviations such as new destinations or protocols.

Monitoring Recommendations

Enable network flow logging on VLANs hosting Tenda CP3 devices and forward records to a centralized analytics platform.
Deploy network intrusion detection signatures for command injection patterns targeting embedded device management interfaces.
Review device syslog output where available for unexpected process launches or reboots.

How to Mitigate CVE-2026-86152

Immediate Actions Required

Remove Tenda CP3 devices running firmware 27.5.57.101 from internet-facing networks and restrict management access to trusted administrative segments.
Place affected cameras behind a firewall that denies inbound access to the Wi-Fi provisioning service from untrusted sources.
Inventory all Tenda CP3 devices in the environment and confirm current firmware versions.

Patch Information

At the time of publication, no vendor patch is referenced in the available advisories. Consult the Tenda official website for the latest firmware releases and security bulletins. Apply any vendor-supplied firmware update as soon as it becomes available.

Workarounds

Segment CP3 devices onto isolated VLANs with no direct route to or from the internet.
Disable the auto-add-Wi-Fi feature if configuration options permit, reducing exposure of the vulnerable code path.
Enforce strict egress filtering so compromised devices cannot reach arbitrary external hosts.
Consider replacing end-of-life or unpatched devices with supported alternatives where prolonged remediation is required.

bash

# Example: restrict inbound access to Tenda CP3 management ports
# Replace 192.0.2.0/24 with the trusted administrative subnet
iptables -A FORWARD -p tcp -s 192.0.2.0/24 -d <cp3_device_ip> --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d <cp3_device_ip> --dport 80 -j DROP
iptables -A FORWARD -d <cp3_device_ip> -j DROP