EUVD-2026-72030
GHSA-38rg-j8xg-2m77
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable command injection with low complexity; authenticated management access is required so PR:L, and full command execution yields C/I/A:H on the single device (scope unchanged).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.
AnalysisAI
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the AlarmVoiceURL argument handled by the SystemAsh function in Apis/system.c (Kylin component). Because the value is passed into a system-level shell call without sanitization, a successful request yields arbitrary command execution on the camera's embedded Linux OS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires sending a request to the SystemAsh function (Apis/system.c, Kylin component) with a malicious AlarmVoiceURL parameter on a Tenda CP3 running firmware 27.5.57.101. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 base score is 9.4 with vector AV:N/AC:L/AT:N/PR:H/UI:N and full high impact to both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is identified at time of analysis; the references point only to VulDB records (https://vuldb.com/vuln/399271) and the Tenda vendor site (https://www.tenda.com.cn/), not to a fixed firmware version, so monitor Tenda's support channels for a firmware update superseding 27.5.57.101 and apply it once available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Tenda CP3 cameras in production and document firmware versions; immediately isolate devices running firmware 27.5.57.101 to a dedicated network segment with restricted access controls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets remote attackers execute arbitrary shell com
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the
Improper privilege management in the Tenda CP3 IP camera (firmware 27.5.57.101) exposes the CRedirServer::SetRedirectEna
Command injection in the ATE (Automatic Test Equipment) module across ten Tenda camera and hub models allows a remote un
Missing authentication on RTSP/ONVIF interfaces across ten Tenda smart camera product lines allows unauthenticated remot
Insufficient entropy in session token generation across ten Tenda smart camera and router models enables remote attacker
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today