Description
A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be initiated remotely.
Published: 2026-09-05
Score: 9.4 Critical
EPSS: 2.9% Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows an attacker to execute arbitrary operating-system commands on devices running Tenda CP3 firmware 27.5.57.101 via the sub_2F77E8 function in Apis/system.c. This weakness is classified as CWE-77 and CWE-78 (OS command injection). The description does not specify additional consequences beyond command execution.

Affected Systems

The vulnerability impacts devices running Tenda CP3 firmware version 27.5.57.101. No other Tenda products or versions are listed as affected.

Risk and Exploitability

The CVSS base score of 9.4 classifies the issue as critical. The EPSS score is 2%, and the vulnerability is not listed in the CISA KEV catalog. The description indicates that the command injection can be triggered remotely, implying high exploitability. The attack can be carried out through the Network Configuration Management interface, according to the supplied information.

Generated by OpenCVE AI on September 6, 2026 at 15:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the device to the latest Tenda CP3 firmware that contains the command-execution fix.
  • If an update is unavailable, disable remote configuration interfaces, such as the web UI or API, to block external input.
  • Restrict management access to the device by permitting only trusted IP addresses or VPN connections.
  • Apply general input validation to all configuration parameters to prevent injection of shell characters.

Generated by OpenCVE AI on September 6, 2026 at 15:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 06 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Tenda cp3
Vendors & Products Tenda cp3

Sun, 06 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be initiated remotely.
Title Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection
First Time appeared Tenda
Tenda cp3 Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:tenda:cp3_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda cp3 Firmware
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X'}

Subscriptions

Tenda Cp3 Cp3 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-11T20:37:13.261Z

Reserved: 2026-09-05T07:40:27.346Z

Link: CVE-2026-86151

cve-icon Vulnrichment

Updated: 2026-09-11T20:15:51.552Z

cve-icon NVD

Status : Deferred

Published: 2026-09-06T00:16:55.773

Modified: 2026-09-11T21:17:33.980

Link: CVE-2026-86151

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-06T16:00:12Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')