EUVD-2026-72030
GHSA-38rg-j8xg-2m77
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach camera management API
-
DeliveryAuthenticate to management interface
-
ExploitSend request with malicious AlarmVoiceURL
-
ExecutionSystemAsh passes value to shell
-
PersistInjected commands execute on device
-
ImpactFull device compromise / network pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires sending a request to the SystemAsh function (Apis/system.c, Kylin component) with a malicious AlarmVoiceURL parameter on a Tenda CP3 running firmware 27.5.57.101. The CVSS vector's PR:H indicates authenticated access to the camera's management interface is required, which is the primary limiting factor; UI:N means no victim interaction is needed once the attacker can reach the endpoint. Network reachability of the management/API interface is also required, so cameras isolated behind a firewall or VPN are not remotely exploitable. |
| Impact | The provided CVSS 4.0 base score is 9.4 with vector AV:N/AC:L/AT:N/PR:H/UI:N and full high impact to both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H). The network attack vector and low complexity make this trivially reachable, but the PR:H metric indicates the vendor/reporter believes authentication (likely an authenticated management session) is required, which meaningfully lowers real-world exposure compared to a pre-auth flaw - this is a notable tension worth verifying, since the terse VulDB description says only that the attack can be 'launched remotely' and does not itself confirm the authentication requirement. There is no EPSS score, no CISA KEV listing, and no published proof-of-concept in the provided data, so exploitation appears theoretical rather than active at this time. The high SC/SI/SA subsequent-system scores appear generous for a single-device command-injection bug and may overstate blast radius. Given full device compromise potential on an internet-exposed camera, operators running Tenda CP3 devices should treat this as urgent regardless of the authentication caveat, particularly where the management interface is reachable from untrusted networks. |
| Exploit ScenarioDerived | An attacker who can reach the camera's management API - for example on a flat network segment or an internet-exposed device - sends a crafted request setting AlarmVoiceURL to a value containing shell metacharacters, causing the SystemAsh handler to execute injected commands. This grants a shell on the camera, from which the attacker can pivot into the local network, capture video, or enroll the device into a botnet. No public proof-of-concept is currently referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 05, 2026
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the AlarmVoiceURL argument handled by the SystemAsh function in Apis/system.c (Kylin component). Because the value is passed into a system-level shell call without sanitization, a successful request yields arbitrary command execution on the camera's embedded Linux OS. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the flaw is remotely reachable.
RemediationAI
No vendor-released patch is identified at time of analysis; the references point only to VulDB records (https://vuldb.com/vuln/399271) and the Tenda vendor site (https://www.tenda.com.cn/), not to a fixed firmware version, so monitor Tenda's support channels for a firmware update superseding 27.5.57.101 and apply it once available. As compensating controls, remove the camera's management/API interface from any internet exposure and place the device on an isolated VLAN reachable only by the NVR or trusted management hosts (trade-off: remote administration must go through a VPN); restrict access to the vulnerable endpoint via an upstream firewall or ACL; change default credentials and disable remote management if the deployment does not require it (trade-off: loss of remote configuration convenience). Because exploitation reportedly requires authenticated access (PR:H), enforcing strong unique credentials materially reduces risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is a Tenda CP3 network surveillance camera (cpe:2.3:a:tenda:cp3), a Linux-based embedded IoT device. The vulnerability is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The SystemAsh routine in Apis/system.c takes the attacker-supplied AlarmVoiceURL parameter - intended to reference an alarm/voice audio resource - and incorporates it into an OS command (likely a shell invocation to fetch or play the resource) without escaping shell metacharacters. Injecting characters such as ';', '|', '&&', or backticks allows an attacker to append arbitrary commands that execute with the privileges of the camera's web/API service, which on such devices is commonly root.
Know when Cp3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable command injection with low complexity; authenticated management access is required so PR:L, and full command execution yields C/I/A:H on the single device (scope unchanged).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.
Technical POC Analysis
The vulnerability is CWE-78, OS command injection.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Tenda CP3 surveillance cameras running firmware 27.5.57.101 contain a critical remote code execution vulnerability allowing remote attackers to seize full control of devices over the network. This compromises physical security monitoring, exposes surveillance data to interception, and creates a potential entry point for attackers to access internal corporate networks.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation-isolate affected cameras to a dedicated VLAN with no routing to critical systems or data networks; (2) Access control-restrict management ports (80, 443, 8080) to administrative IP ranges via firewall; (3) Disable remote management if not operationally required; (4) Enhanced monitoring of camera network traffic for anomalous command activity; (5) Consider operational shutdown of affected units until patches become available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets remote attackers execute arbitrary shell com
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the
Improper privilege management in the Tenda CP3 IP camera (firmware 27.5.57.101) exposes the CRedirServer::SetRedirectEna
Command injection in the ATE (Automatic Test Equipment) module across ten Tenda camera and hub models allows a remote un
Missing authentication on RTSP/ONVIF interfaces across ten Tenda smart camera product lines allows unauthenticated remot
Insufficient entropy in session token generation across ten Tenda smart camera and router models enables remote attacker
Exploit-DB