Tenda CP3 CVE-2026-86152

Exploitation targets the Wi-Fi auto-add onboarding flow handled by CAutoAddWifi::ThreadProc in the Kylin component; the attacker must be able to reach the network service that invokes this function on a Tenda CP3 running firmware 27.5.57.101. Per CVSS (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required and complexity is low, so exploitation is remote and unauthenticated against affected devices. The primary limiting factor is network reachability: the camera's affected service must be accessible to the attacker (e.g. same LAN, or internet-exposed via port-forwarding/cloud bridge), so devices confined to a trusted internal network are substantially harder to reach.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) scores 10.0, describing unauthenticated network command execution with full confidentiality, integrity, and availability impact - a genuinely severe profile for a network-exposed camera, and operators should treat exposed CP3 devices as urgent. That said, several signals temper the raw score: this is a VulDB-sourced report with no independent NVD/vendor corroboration, no EPSS score was provided, it is not listed in CISA KEV, and no public proof-of-concept was supplied, so there is no evidence of active exploitation. The SC/SI/SA:H subsequent-system impact and the 10.0 rating assume the vulnerable process runs with high privilege and can pivot beyond itself, which is plausible for embedded firmware but not independently verified here. Realistic exposure also depends heavily on whether the camera's management interface is reachable from untrusted networks (many are LAN-only or behind NAT unless port-forwarded or cloud-bridged); internet-facing units are at highest risk while purely internal deployments face a lower, though still meaningful, threat.

An attacker who can reach the camera's network service sends a crafted request that feeds shell metacharacters into the Wi-Fi auto-add routine; because CAutoAddWifi::ThreadProc passes the value to an OS command unsanitized, the attacker's commands run on the device. This grants full control - enabling live-feed interception, use of the camera as a foothold into the LAN, or enrollment into a botnet. No public PoC is currently available, but the code location is specifically named, lowering the bar for exploit development.