Description
A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible.
Published: 2026-09-06
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the SetRedirectEnable function of Tenda CP3 firmware exposes improper privilege management that allows an attacker to gain elevated privileges on the device. This weakness can be exploited remotely, enabling an attacker to execute privileged actions or compromise the router’s configuration, thereby threatening confidentiality, integrity, and availability of the network. The vulnerability is classified as high severity with a CVSS score of 9.4 and maps to CWE-266 and CWE-269.

Affected Systems

The issue affects Tenda CP3 units running firmware version 27.5.57.101. Users of this specific firmware should verify their device version and apply available updates.

Risk and Exploitability

The CVSS score indicates a critical severity and the EPSS score is not available, which does not diminish the potential for exploitation. The vulnerability is not listed in CISA’s KEV catalog, but remote exploitation is explicitly possible. With remote access to the router’s interface or network traffic, an attacker can manipulate the SetRedirectEnable setting and elevate privileges to compensate for the improper access control, as detailed by the CWE identifiers.

Generated by OpenCVE AI on September 6, 2026 at 03:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Tenda CP3 firmware update that corrects the SetRedirectEnable privilege handling.
  • If a patch is unavailable, disable or remove the redirect functionality through the router’s configuration settings to eliminate the vulnerable code path.
  • Restrict remote access to the router’s management interface by firewall rules or network segmentation to prevent unauthorized exploitation of the privilege escalation.

Generated by OpenCVE AI on September 6, 2026 at 03:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Tenda cp3
Vendors & Products Tenda cp3

Sun, 06 Sep 2026 02:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible.
Title Tenda CP3 Redirect.cpp SetRedirectEnable privileges management
First Time appeared Tenda
Tenda cp3 Firmware
Weaknesses CWE-266
CWE-269
CPEs cpe:2.3:o:tenda:cp3_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda cp3 Firmware
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X'}

Subscriptions

Tenda Cp3 Cp3 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-06T01:45:15.067Z

Reserved: 2026-09-05T07:40:34.443Z

Link: CVE-2026-86153

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-06T02:17:19.770

Modified: 2026-09-06T02:17:19.770

Link: CVE-2026-86153

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-06T03:30:05Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-269

    Improper Privilege Management