Overview
CVE-2026-86152 is a maximum-severity (CVSS 10.0) OS command injection vulnerability in Tenda CP3 firmware 27.5.57.101, affecting the CAutoAddWifi::ThreadProc function inside Functions/AutoAddWifi.cpp, part of the device's "Kylin" component. It is the most severe of three related vulnerabilities disclosed in this firmware build — see CVE-2026-86151 and CVE-2026-86153.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-86152 |
| CWE | CWE-78 (OS Command Injection) |
| Severity | Critical (CVSS 10.0 — maximum) |
| Attack Vector | Network |
| Affected Function | CAutoAddWifi::ThreadProc in Functions/AutoAddWifi.cpp |
| Component | Kylin (Wi-Fi auto-provisioning) |
| Exploit Availability | No public PoC at time of writing |
How It Works
CAutoAddWifi::ThreadProc runs as part of Tenda's Wi-Fi auto-provisioning workflow, which handles adding new wireless clients or configuring SSIDs. The thread builds and executes an OS command using externally-influenced input without neutralizing shell metacharacters, so a crafted request can append arbitrary commands to whatever the process intends to run. Because the flaw sits in a background worker thread tied to Wi-Fi provisioning rather than behind an authenticated admin panel, VulDB rates the exploit path as remotely reachable with no listed authentication requirement — consistent with the maximum CVSS score assigned.
Impact Assessment
A CVSS 10.0 score reflects full compromise of confidentiality, integrity, and availability with no privileges or user interaction required. On Tenda CP3 hardware, successful exploitation grants command execution in the context of the device's core management process, effectively handing the attacker the device. From there, an attacker can:
- Exfiltrate video/network traffic passing through the device
- Modify Wi-Fi configuration to intercept or redirect client traffic
- Install persistent implants for botnet recruitment (a common outcome for command-injection bugs in cheap consumer/SMB network hardware)
- Pivot into the internal network the device sits on
Mitigation
- Check Tenda's official channels for a firmware update addressing CVE-2026-86152; none was referenced in the initial disclosure, so treat this as unpatched until confirmed otherwise.
- Isolate the device — do not expose CP3 management or provisioning services to the public internet; restrict access to a trusted LAN or VPN.
- Disable Wi-Fi auto-provisioning/auto-add features if not actively needed, to reduce the exposed attack surface.
- Segment IoT/camera hardware on its own VLAN so a compromised unit cannot directly reach critical internal systems.
- Treat any Tenda CP3 device showing unexpected outbound connections or configuration drift as potentially compromised and reimage/replace it.