Which versions of Tenda Smart Camera are affected by CVE-2026-19747?

Tenda's camera and hub products used for facility monitoring are vulnerable to unauthenticated remote code execution affecting ten models.

How to fix or mitigate CVE-2026-19747?

Within 24 hours, conduct a network audit to identify all affected Tenda camera and hub models and immediately isolate them on restricted VLANs, blocking untrusted inbound access. Within 7 days, establish a device replacement roadmap since no vendor-released patch is currently available; implement interim network controls including egress monitoring to detect command-execution attempts and API gateway authentication upstream of all affected devices. Within 30 days, execute a phased replacement plan prioritizing internet-facing and security-critical camera deployments, and completely retire all affected Tenda models from production.

Tenda Smart Camera CVE-2026-19747

Q: What is the CVSS score of CVE-2026-19747?

CVE-2026-19747 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.4%.

EUVD-2026-58370 HIGH

Command Injection (CWE-77)

2026-08-13 VulDB

GHSA-vqr8-q3rg-fr3w

Command Injection Tenda Ch7 Ch7G Ch10 Cp3 Cp3 Pro Cp7 Tc3B14C Tc3B15C Tc3T14C Tc3T15C

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network vector and no-auth confirmed by CVSS 4.0 source; scope unchanged as device-local impact only; full triad impact from arbitrary command execution.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:40 vuln.today

Severity Changed

Aug 13, 2026 - 20:22 NVD

CRITICAL HIGH

CVSS changed

Aug 13, 2026 - 20:22 NVD

9.3 (CRITICAL) 8.9 (HIGH)

CVE Published

Aug 13, 2026 - 19:45 cve.org

HIGH 8.9

DescriptionCVE.org

A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely.

AnalysisAI

Command injection in the ATE (Automatic Test Equipment) module across ten Tenda camera and hub models allows a remote unauthenticated attacker to execute arbitrary OS commands on affected devices. The vulnerable function CAte::HandleCmd in the Kylin binary fails to sanitize user-supplied input before passing it to a system command interpreter (CWE-77), granting full device compromise. A proof-of-concept exists on GitHub (E:P in the CVSS 4.0 supplemental metrics) and no KEV listing is present at time of analysis, though the unauthenticated network vector and PoC availability elevate near-term exploitation risk.

Technical ContextAI

The affected component is the ATE (Automatic Test Equipment) module, a diagnostic and factory-test interface embedded in Tenda's IoT camera firmware and commonly left network-accessible in consumer and SMB deployments. The vulnerable function CAte::HandleCmd resides in a binary named Kylin and processes incoming commands without sanitizing shell metacharacters, directly invoking them via a system call (CWE-77: Improper Neutralization of Special Elements used in a Command). Affected CPEs span ten distinct product lines - cpe:2.3:a:tenda:ch7, ch7g, ch10, cp3, cp3_pro, cp7, tc3b14c, tc3b15c, tc3t14c, tc3t15c - all versions up to 20260625 per the firmware date string. This class of ATE module vulnerability is a recurring pattern in low-cost IoT firmware where test interfaces are not stripped before production release.

RemediationAI

No vendor-released patch or fixed firmware version has been identified at time of analysis - patch status is unconfirmed and should be verified directly with Tenda at https://www.tenda.com.cn/. Until a patch is available, defenders should implement compensating controls: disable or firewall the ATE diagnostic interface at the network perimeter, blocking any port or service associated with the Kylin/ATE module from LAN and WAN access. If the ATE port is identifiable via firmware analysis or the published PoC, add a host-based firewall rule on upstream routers to drop inbound connections to that service. Avoid exposing these camera models directly to the internet via port forwarding or DMZ placement. Network segmentation placing IoT cameras on an isolated VLAN with no lateral access to production systems reduces blast radius if exploitation occurs. Monitor VulDB (https://vuldb.com/cve/CVE-2026-19747) for patch releases.