Fengzi

**Name of the Vulnerable Software and Affected Versions** Tenda CP3 version 27.5.57.101 **Description** A flaw in the Kylin component allows for remote OS command injection. The issue exists within the `CAutoAddWifi::ThreadProc()` function located in the Functions/AutoAddWifi.cpp file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

🚨 CVE-2026-86153 A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible. 🎖@cveNotify

🚨 CVE-2026-86148 A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely. 🎖@cveNotify

🚨 CVE-2026-86149 A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface name/host causes os command injection. The attack can be initiated remotely. 🎖@cveNotify

🚨 CVE-2026-86150 A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa passphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. 🎖@cveNotify

🚨 CVE-2026-86151 A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub 2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be initiated remotely. 🎖@cveNotify