Fengzi

**Nome do Software Vulnerável e Versões Afetadas** Tenda CP3 versão 27.5.57.101 **Descrição** Uma falha no componente Kylin permite a injeção remota de comandos do sistema operacional. O problema reside na função `CAutoAddWifi::ThreadProc()` localizada no arquivo Functions/AutoAddWifi.cpp. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha a correção para esta vulnerabilidade.

🚨 CVE-2026-86153 A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible. 🎖@cveNotify

🚨 CVE-2026-86148 A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely. 🎖@cveNotify

🚨 CVE-2026-86149 A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface name/host causes os command injection. The attack can be initiated remotely. 🎖@cveNotify

🚨 CVE-2026-86150 A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa passphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. 🎖@cveNotify

🚨 CVE-2026-86151 A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub 2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be initiated remotely. 🎖@cveNotify