Cyber & AI intelligence
Wasteland.
Briefs indexed2444
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-86148 2026-09-05

Tenda CP3 Camera Hit With Critical Command Injection Flaw (CVE-2026-86148)

"A remotely reachable OS command injection bug in the Tenda CP3 camera firmware 27.5.57.101 lets an attacker with high privileges execute arbitrary commands through the `AlarmVoiceURL` parameter, scoring 9.1 CRITICAL."

A remotely reachable OS command injection bug in the Tenda CP3 camera firmware 27.5.57.101 lets an attacker with high privileges execute arbitrary commands through the AlarmVoiceURL parameter, scoring 9.1 CRITICAL.

What Is It

CVE-2026-86148 is an OS command injection vulnerability in Tenda CP3 firmware version 27.5.57.101. The flaw sits in the SystemAsh function in Apis/system.c, part of the Kylin component. Manipulating the AlarmVoiceURL argument results in command injection, and the attack can be launched remotely.

It is classified under CWE-77 (command injection) and CWE-78 (OS command injection), and was published to NVD on 2026-09-05 by VulDB as the reporting CNA.

Why It Matters

The CVSS 3.1 base score is 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. VulDB also assigned a CVSS 4.0 score of 9.4 (CRITICAL) and a legacy CVSS 2.0 score of 8.3 (HIGH).

The important parts of that vector: network attack vector, low attack complexity, and no user interaction required. Scope is marked Changed, with High impact to confidentiality, integrity, and availability; meaning successful exploitation reaches beyond the vulnerable component itself. The one meaningful barrier is that privileges required is rated High, so an attacker needs elevated access on the device before reaching the vulnerable code path.

The data reviewed for this brief contains no CISA KEV entry for this CVE, which suggests there is no publicly confirmed active exploitation and no federal remediation deadline as of writing. A KEV listing is a lagging indicator, though; its absence should not be read as assurance that the flaw is not being exploited.

What's Vulnerable

Patch Status

The source material reviewed here does not list a vendor patch, fixed version, or advisory URL, and no required action or remediation guidance appears in the available data. NVD status is Received, meaning the record has not yet completed analysis; so a vendor fix or advisory may exist without being reflected in these records yet. Operators running CP3 firmware 27.5.57.101 should check the vendor site for firmware updates and restrict management-plane access to the device in the meantime.

Sources