Vulnerability · Published Sep 5, 2026 · Assigned by VulDB
CVE-2026-86151Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection
Critical 9.1
In plain English
A critical-severity OS command injection in CP3 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)2.9%top 12.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be initiated remotely.
Affected products (as reported)
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R
References
- VDB-399274 | Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection vdb-entry, technical-description
- VDB-399274 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-86151 | CVE Analysis and Report third-party-advisory
- Submit #895352 | Tenda CP3 V3.2 V27.5.57.101 OS Command Injection third-party-advisory
- https://www.tenda.com.cn/ product