Tenda Smart Camera CVE-2026-19747

The ATE (Automatic Test Equipment) module must be network-reachable on the target device - this interface is typically active by default in Tenda firmware and is not gated by user authentication (PR:N per the CVSS 4.0 vector). No special configuration, account credentials, or user interaction are required. The attack is constrained to devices running firmware builds dated 20260625 or earlier across the ten listed model lines; the TC3 variants (TC3B14C, TC3B15C, TC3T14C, TC3T15C) and CP/CH families are all affected. Exploitation is limited to the firmware's OS user context on the camera - there is no scope change to downstream systems (SC:N/SI:N/SA:N). Network exposure level (LAN-only vs. internet-facing) determines the breadth of potential attackers.

The CVSS 4.0 base score of 8.9 with AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H reflects the most severe exploitation conditions: network-reachable, zero complexity, no authentication, no user interaction, and full triad impact. The E:P supplemental metric confirms a proof-of-concept exists, which substantially narrows the gap between vulnerability disclosure and opportunistic exploitation. No CISA KEV listing is present, but the PoC hosted on GitHub (https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability) means this is not a theoretical risk. EPSS data is not available in the provided input - this gap should be noted. The ATE module is often exposed on LAN-accessible or occasionally WAN-facing interfaces depending on deployment. Real-world risk is high for unpatched devices reachable over the network, particularly given that IoT cameras frequently lack automatic update mechanisms and may remain unpatched indefinitely.

An attacker with network access to the device sends a specially crafted request to the ATE module's network interface, embedding OS shell metacharacters in a parameter processed by CAte::HandleCmd. Because the Kylin binary passes this input directly to a command interpreter without sanitization, the injected command executes with the device firmware's runtime privileges. A publicly available proof-of-concept on GitHub lowers the skill bar, enabling script-kiddie exploitation against any reachable device.