CVE-2026-86151
Received Received - Intake

OS Command Injection in Tenda CP3 Router

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulDB

Description
A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be initiated remotely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86151
EUVD
EUVD-2026-72036

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tenda cp3 27.5.57.101

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in Tenda CP3 version 27.5.57.101. It exists in the function sub_2F77E8 within the file Apis/system.c, specifically in the Network Configuration Management component. An attacker can remotely exploit this to execute arbitrary commands on the system.

Detection Guidance

Detecting this vulnerability requires checking for command injection attempts in the Tenda CP3 device's network configuration management. Monitor logs for unusual commands or payloads in HTTP requests targeting the Apis/system.c component. Use network scanners to identify exposed Tenda CP3 devices with firmware version 27.5.57.101.

Impact Analysis

The impact includes unauthorized remote command execution, potentially leading to full system compromise. Attackers could gain control over the device, steal sensitive data, or use it as a pivot point for further network attacks. The high CVSS scores indicate severe potential damage.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR (data protection) and HIPAA (health data privacy). Non-compliance may result in legal penalties, fines, and reputational damage due to unauthorized access to sensitive information.

Mitigation Strategies

Immediately isolate affected Tenda CP3 devices from your network to prevent remote exploitation. Update the device firmware to the latest version if a patch is available. Disable remote administration features if not required. Monitor network traffic for signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86151. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart