Tc3T15C
Monthly
Command injection in the ATE (Automatic Test Equipment) module across ten Tenda camera and hub models allows a remote unauthenticated attacker to execute arbitrary OS commands on affected devices. The vulnerable function CAte::HandleCmd in the Kylin binary fails to sanitize user-supplied input before passing it to a system command interpreter (CWE-77), granting full device compromise. A proof-of-concept exists on GitHub (E:P in the CVSS 4.0 supplemental metrics) and no KEV listing is present at time of analysis, though the unauthenticated network vector and PoC availability elevate near-term exploitation risk.
Missing authentication on RTSP/ONVIF interfaces across ten Tenda smart camera product lines allows unauthenticated remote attackers to access live video streams without credentials. Affected devices include CH7, CH7G, CH10, CP3, CP3 Pro, CP7, and the TC3-series (TC3B14C, TC3B15C, TC3T14C, TC3T15C) running firmware through 20260625. Public proof-of-concept exploit code exists on GitHub (E:P per CVSS 4.0 supplemental metrics), though high attack complexity (AC:H) limits trivial mass exploitation; no vendor patch has been identified at time of analysis.
Insufficient entropy in session token generation across ten Tenda smart camera and router models enables remote attackers to predict or brute-force valid session identifiers, potentially hijacking authenticated sessions on the Kylin Web Service. All affected models up to firmware build 20260625 are impacted via the CWebSessionManager_ParseSession function in /user/bin/Kylin. A publicly available proof-of-concept exploit is referenced on GitHub, though the CVSS 4.0 E:P modifier and AC:H rating confirm that exploitation is technically demanding rather than trivially scriptable; no active exploitation has been confirmed by CISA KEV.
Command injection in the ATE (Automatic Test Equipment) module across ten Tenda camera and hub models allows a remote unauthenticated attacker to execute arbitrary OS commands on affected devices. The vulnerable function CAte::HandleCmd in the Kylin binary fails to sanitize user-supplied input before passing it to a system command interpreter (CWE-77), granting full device compromise. A proof-of-concept exists on GitHub (E:P in the CVSS 4.0 supplemental metrics) and no KEV listing is present at time of analysis, though the unauthenticated network vector and PoC availability elevate near-term exploitation risk.
Missing authentication on RTSP/ONVIF interfaces across ten Tenda smart camera product lines allows unauthenticated remote attackers to access live video streams without credentials. Affected devices include CH7, CH7G, CH10, CP3, CP3 Pro, CP7, and the TC3-series (TC3B14C, TC3B15C, TC3T14C, TC3T15C) running firmware through 20260625. Public proof-of-concept exploit code exists on GitHub (E:P per CVSS 4.0 supplemental metrics), though high attack complexity (AC:H) limits trivial mass exploitation; no vendor patch has been identified at time of analysis.
Insufficient entropy in session token generation across ten Tenda smart camera and router models enables remote attackers to predict or brute-force valid session identifiers, potentially hijacking authenticated sessions on the Kylin Web Service. All affected models up to firmware build 20260625 are impacted via the CWebSessionManager_ParseSession function in /user/bin/Kylin. A publicly available proof-of-concept exploit is referenced on GitHub, though the CVSS 4.0 E:P modifier and AC:H rating confirm that exploitation is technically demanding rather than trivially scriptable; no active exploitation has been confirmed by CISA KEV.