EUVD-2026-72038
GHSA-3557-5v9r-p922
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach CP3 camera web service
-
DeliverySend request to SetRedirectEnable handler
-
ExploitBypass privilege check (CWE-269)
-
ExecutionAlter redirect configuration
-
ImpactImpact camera integrity/control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the CRedirServer::SetRedirectEnable function reachable over the network (AV:N) on a Tenda CP3 running firmware 27.5.57.101; the attacker must be able to reach the camera's redirect/web service. The provided CVSS vector specifies PR:H, indicating high privileges are nominally required, which conflicts with the improper-privilege-management (CWE-269) nature of the finding - this contradiction means the true authentication prerequisite is not reliably confirmed from available data and should be validated with the vendor. Limiting factors: the camera's management interface must be network-accessible to the attacker (default deployments behind NAT/LAN reduce internet exposure), and only the specific firmware build 27.5.57.101 is confirmed affected. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H = 9.4) is internally inconsistent and should be treated with caution: it asserts PR:H (attacker already holds high privileges) which contradicts the premise of an improper-privilege-management/escalation bug, and it claims full high impact on both the vulnerable and subsequent systems plus a scope change, which the terse one-line description does not substantiate for a single redirect-enable setter. There is no EPSS score, no CISA KEV listing, and no POC referenced - only a VulDB advisory. Realistically this reads as a genuine authorization weakness on a network-reachable camera, but the 9.4 severity is likely overstated; verify the actual pre- and post-conditions and true impact with the vendor before treating it as a top-tier priority. EPSS and exploit-maturity data are missing, consistent with a freshly published VulDB entry rather than a widely weaponized flaw. |
| Exploit ScenarioDerived | An attacker with network reachability to a Tenda CP3 camera's web service sends a crafted request to the redirect-enable handler, and because the SetRedirectEnable path does not properly enforce the required privilege level, the attacker changes the camera's redirect configuration without holding legitimate authorization. No public exploit code is available, and the exact request format is not documented in the single-source advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Improper privilege management in the Tenda CP3 IP camera (firmware 27.5.57.101) exposes the CRedirServer::SetRedirectEnable function (Functions/Redirect.cpp) to remote abuse, letting an attacker toggle the device's redirect handling without proper authorization enforcement. The flaw was disclosed by VulDB (vuln #399276) and carries a CVSS 4.0 base score of 9.4, though no public exploit code and no active-exploitation evidence accompany the entry. No public exploit identified at time of analysis, and the single-source, sparse disclosure limits how much of the claimed impact can be independently confirmed.
RemediationAI
No vendor-released patch identified at time of analysis - the only Tenda reference is the generic corporate homepage (https://www.tenda.com.cn/) with no fixed firmware version cited, so monitor Tenda support for a firmware release superseding 27.5.57.101 and apply it once published. In the interim, apply compensating controls: place CP3 cameras on an isolated management VLAN and block their web/redirect service from untrusted networks and the internet (trade-off: remote viewing/administration must then go through a hardened VPN), restrict access to the camera's HTTP interface to specific administrator source IPs via ACL, and disable remote/cloud access features if the deployment does not require them. Track updates via the VulDB entry https://vuldb.com/vuln/399276.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tenda CP3 is a consumer/SMB network IP security camera; the CPE cpe:2.3:a:tenda:cp3:*:*:*:*:*:*:*:* identifies the affected product (labelled as an application component although CP3 is embedded camera firmware). The vulnerable code is a C++ server method, CRedirServer::SetRedirectEnable, implying an HTTP/redirect service running on the camera. The root cause is CWE-269 (Improper Privilege Management): the function performs a privileged state change (enabling/disabling redirect) without correctly validating that the caller holds the required authorization, so the privilege boundary intended to guard that operation is not enforced.
Know when Cp3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable authorization flaw likely usable from a low-privilege context (PR:L, not PR:H), enabling a config state change with modest confidentiality/integrity impact; full high impact and scope change are unsupported by the sparse description.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible.
Executive ViewAI
Tenda CP3 IP cameras (firmware 27.5.57.101) contain a privilege escalation vulnerability allowing remote attackers to reconfigure the device's redirect settings without proper authorization, potentially enabling interception or redirection of camera streams to attacker-controlled systems. Organizations deploying these network-connected cameras for facility surveillance face operational risks including loss of visibility and potential data interception. No patch is currently available, and the disclosure is limited to a single source with unverified impact claims.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network segmentation via VLAN or firewall rules restricting Tenda CP3 camera access to authorized management networks; (2) Disable the redirect feature in the camera web interface if not required for operations; (3) Monitor network traffic and camera access logs for unauthorized SetRedirectEnable function invocations or unusual outbound connections; (4) Evaluate firmware rollback to earlier versions if available and stability-tested; (5) Plan replacement with alternative camera vendors demonstrating timely security patching; (6) Enforce strong authentication and change default credentials on all camera management interfaces.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Related Vulnerabilities in Tenda CP3 Command Injection and Privilege Flaws
View all 3OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets attackers inject shell commands through the
Command injection in the ATE (Automatic Test Equipment) module across ten Tenda camera and hub models allows a remote un
Missing authentication on RTSP/ONVIF interfaces across ten Tenda smart camera product lines allows unauthenticated remot
Insufficient entropy in session token generation across ten Tenda smart camera and router models enables remote attacker
Exploit-DB