EUVD-2026-58391
GHSA-6ww3-pvc7-5crf
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no prior auth, but high complexity for token prediction; impact is limited confidentiality only, no integrity or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument SESSION leads to insufficient entropy. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult.
AnalysisAI
Insufficient entropy in session token generation across ten Tenda smart camera and router models enables remote attackers to predict or brute-force valid session identifiers, potentially hijacking authenticated sessions on the Kylin Web Service. All affected models up to firmware build 20260625 are impacted via the CWebSessionManager_ParseSession function in /user/bin/Kylin. A publicly available proof-of-concept exploit is referenced on GitHub, though the CVSS 4.0 E:P modifier and AC:H rating confirm that exploitation is technically demanding rather than trivially scriptable; no active exploitation has been confirmed by CISA KEV.
Technical ContextAI
The Kylin Web Service is a lightweight HTTP daemon embedded in Tenda IoT devices, responsible for session management across the web administration interface. The vulnerable function CWebSessionManager_ParseSession, located in the binary /user/bin/Kylin, generates or validates session tokens using a source of randomness with insufficient entropy (CWE-331). Weak session token entropy means an attacker with network access to the device's web interface can enumerate or statistically predict valid session identifiers without authenticating. Affected CPE strings cover ten distinct product lines - cpe:2.3:a:tenda:ch7, ch7g, ch10, cp3, cp3_pro, cp7, tc3b14c, tc3b15c, tc3t14c, and tc3t15c - all sharing the same Kylin codebase through at least firmware version 20260625. The root cause class (CWE-331) typically manifests as use of a low-quality PRNG, a short token length, a predictable seed such as system uptime, or a restricted token character space.
RemediationAI
No vendor-released patch has been identified at the time of analysis; the Tenda vendor page (https://www.tenda.com.cn/) should be monitored for firmware updates addressing CVE-2026-19748. As an immediate compensating control, restrict network access to the Kylin Web Service management port by placing affected devices behind a firewall or access control list that blocks untrusted hosts from reaching the web administration interface - this eliminates the remote network vector entirely but does not fix the underlying entropy flaw. If remote management is operationally required, place the device behind a VPN and require VPN authentication before the management port is reachable, accepting the operational overhead of VPN credential management. Forcing frequent session expiry through device settings (if available) reduces the window for token prediction attacks. Disabling web-based management and using alternative management channels (if supported) is the most aggressive compensating control. The GitHub researcher disclosure is at https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Weak%20Bypass/Tenda%20Camera%20Weak%20Session%20Authentication%20Bypass.md and the VulDB submission is at https://vuldb.com/submit/868490.
Command injection in the ATE (Automatic Test Equipment) module across ten Tenda camera and hub models allows a remote un
Missing authentication on RTSP/ONVIF interfaces across ten Tenda smart camera product lines allows unauthenticated remot
Same weakness CWE-331 – Insufficient Entropy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today