A critical (CVSS 9.1) OS command injection flaw in Tenda CP3 firmware 27.5.57.101 lets a remote attacker with high privileges inject arbitrary commands through the network ping handler.
What Is It
CVE-2026-86149 is an OS command injection weakness (CWE-77 / CWE-78) in Tenda CP3 version 27.5.57.101. The flaw resides in unspecified processing within the file Net/NetCheckPing.cpp. Manipulation of the interface_name and host arguments results in command injection, and the attack can be initiated remotely.
The record was published on 2026-09-05 by VulDB as the CNA and currently carries NVD status "Received," meaning it has not yet completed NVD analysis.
Why It Matters
The CVSS 3.1 base score is 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Network attack vector, low attack complexity, and no user interaction requirement mean the flaw can be triggered remotely without tricking an operator. The scope is CHANGED, with HIGH impact to confidentiality, integrity, and availability; command injection on this class of device typically means control over the device itself and anything reachable from it.
The one mitigating factor in the vector is that privileges required are HIGH: an attacker needs elevated access before reaching the vulnerable code path. VulDB's separate CVSS 4.0 assessment scores it 9.4 (CRITICAL), with HIGH subsequent-system impact across all three properties, reflecting the potential for the compromise to extend beyond the vulnerable component.
What's Vulnerable
- Vendor: Tenda
- Product: CP3
- Affected version: 27.5.57.101 (
cpe:2.3:o:tenda:cp3_firmware) - Vulnerable component:
Net/NetCheckPing.cpp, via theinterface_name/hostarguments
Patch Status
No patch, fixed version, or vendor advisory is present in the supplied source material. The sources reviewed here also do not establish whether the CVE has been added to CISA's Known Exploited Vulnerabilities catalog, so organizations subject to BOD 22-01 should check the KEV catalog directly rather than assume a remediation deadline does or does not apply. Operators running Tenda CP3 27.5.57.101 should restrict network reachability of the device's management interfaces and monitor the vendor site for firmware updates.