CVE-2026-19747

Received Received - Intake

Command Injection Vulnerability in Tenda CH7 Series Devices

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulDB

Description

A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-19747

EUVD

EUVD-2026-58370

Affected Vendors & Products

Vendor	Product	Version / Range
tenda	ch7	*
tenda	ch7g	*
tenda	ch10	*
tenda	cp3	*
tenda	cp3_pro	*
tenda	cp7	*
tenda	tc3b14c	*
tenda	tc3b15c	*
tenda	tc3t14c	*
tenda	tc3t15c	to 20260625 (inc)
tenda	ch7	to 20260625 (inc)
tenda	ch7g	to 20260625 (inc)
tenda	ch10	to 20260625 (inc)
tenda	cp3	to 20260625 (inc)
tenda	cp3_pro	to 20260625 (inc)
tenda	cp7	to 20260625 (inc)
tenda	tc3b14c	to 20260625 (inc)
tenda	tc3b15c	to 20260625 (inc)
tenda	tc3t14c	to 20260625 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a critical unauthenticated command injection vulnerability in Tenda smart camera firmware. It exists in the Kylin binary's ATE module, specifically in the CAte::HandleCmd function. The flaw allows remote attackers to execute arbitrary commands on vulnerable devices without authentication by sending specially crafted JSON packets to UDP port 7320. The vulnerability arises from improper input validation where user-controlled data is directly concatenated into system commands and executed via popen.

Detection Guidance

Scan for open UDP port 7320 on Tenda devices using nmap: nmap -sU -p 7320 <target_IP>
Check for the presence of the Kylin binary in /usr/bin/Kylin on affected devices
Monitor network traffic for unexpected UDP packets to port 7320 from untrusted sources

Impact Analysis

This vulnerability could allow attackers to take full control of your Tenda smart camera remotely without any authentication. They could steal sensitive data from your device, install malware, or use your camera as a pivot point to attack other devices on your network. The high CVSS scores indicate this is a severe risk with potential for complete system compromise.

Mitigation Strategies

Immediately isolate affected Tenda devices from the network. Disable UDP port 7320 if possible. Update firmware to the latest version if a patch is available. Implement strict network segmentation and access controls for these devices.

Hi! I’m here to help you understand CVE-2026-19747. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70