EUVD-2026-72031
GHSA-qh73-x3c2-xph4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach camera web interface
-
DeliveryAuthenticate with privileged session
-
ExploitSubmit ping request with malicious host/interface_name
-
ExecutionBreak out of ping via shell metacharacters
-
PersistExecute arbitrary command as device service
-
ImpactFull device compromise / pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the Tenda CP3 network-check/ping diagnostic function (NetCheckPing.cpp) over the network and supplying crafted interface_name or host parameters containing shell metacharacters. The provided CVSS vector specifies PR:H, indicating an authenticated session with elevated (likely administrative) privileges is required - this is the primary limiting factor and means the endpoint is not exploitable pre-authentication in the reporter's assessment. Limiting factors: the diagnostic endpoint must be network-reachable (not exposed if the camera is on an isolated segment), a valid privileged session is needed, and only firmware 27.5.57.101 is confirmed affected. No user interaction is required (UI:N). |
| Impact | The CVSS 4.0 base score of 9.4 reflects network attack vector, low complexity, and high impact to confidentiality, integrity and availability, but it carries PR:H (privileges required) and marks a scope change (SC/SI/SA:H) - meaning even the reporter treats this as requiring elevated access, not a pure pre-auth flaw. That PR:H is the single most important caveat: on a ping/diagnostic endpoint, exploitation most plausibly requires an authenticated (often admin) web session, so real-world risk is materially lower than the near-10 score suggests, especially given no EPSS score, no KEV listing, and no public PoC. The subsequent-system impact flags (SC:H/SI:H/SA:H) appear overstated for a self-contained embedded device with no obvious downstream system. Overall this is a genuine RCE-class bug but currently rates as a targeted, post-authentication risk rather than a wormable internet-wide threat; independent verification of the auth requirement is warranted since VulDB-sourced entries frequently under-document the exact privilege prerequisite. |
| Exploit ScenarioDerived | An attacker who can reach the camera's web interface and obtain (or already holds) an administrative session submits a network-check request setting the host or interface_name field to a value like '8.8.8.8; telnetd -l /bin/sh -p 9999', causing the device to execute the injected command and open a root shell. From there the attacker pivots into the internal network or enrolls the camera into a botnet. No public PoC is currently available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 05, 2026
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the interface_name and host arguments handled in Net/NetCheckPing.cpp, yielding arbitrary command execution on the device. The network-connectivity/ping diagnostic routine passes attacker-controlled input into a system shell without sanitization, and the attack is reachable over the network. No public exploit identified at time of analysis; the sole source is a VulDB submission.
RemediationAI
No vendor-released patch identified at time of analysis; monitor https://www.tenda.com.cn/ and the VulDB record (https://vuldb.com/vuln/399272) for a fixed firmware build and apply it once published. As compensating controls, remove the camera from direct internet exposure and place it on an isolated VLAN reachable only by the video-management server, which prevents remote reach at the cost of remote administrative convenience; restrict access to the device's web/diagnostic interface via firewall rules so only trusted management hosts can reach it; and change any default administrative credentials, since the flaw most plausibly requires an authenticated session and strong unique credentials sharply raise the bar. Disable or block the network-check/ping diagnostic feature if the device configuration allows it. These controls reduce exposure but do not eliminate the underlying injection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda CP3 is a consumer/SMB IP surveillance camera running embedded Linux. The flaw is a classic CWE-78 OS command injection: the NetCheckPing.cpp routine builds a shell command string for a network reachability check (ping) and concatenates the user-supplied interface_name and host values directly into it. Because the values are neither validated nor passed via an argv/execvp-style safe API, shell metacharacters (;, |, `, $()) break out of the intended ping invocation and execute as additional commands with the privileges of the camera's web/diagnostic service (typically root on such devices). CPE cpe:2.3:a:tenda:cp3 confirms the affected product line.
Know when Cp3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable command injection with high device impact; PR:L rather than PR:N because a diagnostic endpoint most plausibly needs an authenticated session, and S:U since a self-contained embedded device shows no separate impacted system.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be initiated remotely.
Executive ViewAI
Tenda CP3 IP cameras running firmware 27.5.57.101 contain a remote command injection vulnerability in the network diagnostics function, allowing attackers to gain complete control of surveillance infrastructure without authentication. Organizations lose visibility into monitored areas, face unauthorized access to recorded video, and create a network access point for lateral movement into connected systems. No vendor patch is available, making immediate containment critical.
No vendor-released patch identified at time of analysis. Implement: (1) Network segmentation isolating camera VLANs from production networks; (2) Firewall rules restricting management port access to authorized administrators with IP allowlisting; (3) Disable remote diagnostics and ping functions through device settings where available; (4) Network intrusion detection targeting suspicious command patterns on camera management ports; (5) Continuous access logging and monitoring for unauthorized management console connections; (6) Temporary operational redundancy using unaffected cameras or alternative systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets remote attackers execute arbitrary shell com
Improper privilege management in the Tenda CP3 IP camera (firmware 27.5.57.101) exposes the CRedirServer::SetRedirectEna
Command injection in the ATE (Automatic Test Equipment) module across ten Tenda camera and hub models allows a remote un
Missing authentication on RTSP/ONVIF interfaces across ten Tenda smart camera product lines allows unauthenticated remot
Insufficient entropy in session token generation across ten Tenda smart camera and router models enables remote attacker
Exploit-DB