EUVD-2026-72038
GHSA-3557-5v9r-p922
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable authorization flaw likely usable from a low-privilege context (PR:L, not PR:H), enabling a config state change with modest confidentiality/integrity impact; full high impact and scope change are unsupported by the sparse description.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible.
AnalysisAI
Improper privilege management in the Tenda CP3 IP camera (firmware 27.5.57.101) exposes the CRedirServer::SetRedirectEnable function (Functions/Redirect.cpp) to remote abuse, letting an attacker toggle the device's redirect handling without proper authorization enforcement. The flaw was disclosed by VulDB (vuln #399276) and carries a CVSS 4.0 base score of 9.4, though no public exploit code and no active-exploitation evidence accompany the entry. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the CRedirServer::SetRedirectEnable function reachable over the network (AV:N) on a Tenda CP3 running firmware 27.5.57.101; the attacker must be able to reach the camera's redirect/web service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H = 9.4) is internally inconsistent and should be treated with caution: it asserts PR:H (attacker already holds high privileges) which contradicts the premise of an improper-privilege-management/escalation bug, and it claims full high impact on both the vulnerable and subsequent systems plus a scope change, which the terse one-line description does not substantiate for a single redirect-enable setter. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis - the only Tenda reference is the generic corporate homepage (https://www.tenda.com.cn/) with no fixed firmware version cited, so monitor Tenda support for a firmware release superseding 27.5.57.101 and apply it once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct a network scan to locate all Tenda CP3 cameras and confirm firmware version 27.5.57.101 on identified devices; if critical to security operations, apply emergency network isolation via VLAN segmentation or firewall access control lists restricting camera access to trusted administrative subnets only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets remote attackers execute arbitrary shell com
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the
Command injection in the ATE (Automatic Test Equipment) module across ten Tenda camera and hub models allows a remote un
Missing authentication on RTSP/ONVIF interfaces across ten Tenda smart camera product lines allows unauthenticated remot
Insufficient entropy in session token generation across ten Tenda smart camera and router models enables remote attacker
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today