Overview
A critical OS command injection vulnerability has been disclosed in the Tenda CP3 smart camera/router firmware, version 27.5.57.101. Tracked as CVE-2026-86151, the flaw sits in the sub_2F77E8 function of Apis/system.c, part of the device's Network Configuration Management component, and can be triggered remotely to execute arbitrary operating system commands.
The bug was reported by researcher "FengZi" via VulDB and is one of three related command-injection and privilege-management flaws disclosed in Tenda CP3 firmware on the same day — see CVE-2026-86152 and CVE-2026-86153.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-86151 |
| CWE | CWE-78 (OS Command Injection) |
| Severity | Critical (CVSS 9.1) |
| Attack Vector | Network |
| Affected Function | sub_2F77E8 in Apis/system.c |
| Component | Network Configuration Management |
| Exploit Availability | No public PoC at time of writing |
How It Works
The vulnerable function processes network configuration requests, likely reachable via the device's web management interface or an exposed API endpoint. Input that reaches sub_2F77E8 is passed into an OS command without adequate sanitization, allowing shell metacharacters (semicolons, pipes, backticks) to be smuggled through and executed with the privileges of the underlying process.
Impact Assessment
Tenda CP3 units are consumer/SMB-grade network cameras with router-like network management functionality, commonly deployed with minimal hardening and often left internet-facing for remote viewing. A successful exploit against this class of function typically yields command execution as the device's system user, which on embedded Linux-based router/camera firmware usually has broad access to the filesystem and network stack — enough to pivot into the LAN, exfiltrate video streams, or conscript the device into a botnet.
Potential Attack Chains
- Attacker reaches the network configuration endpoint remotely (directly if internet-exposed, or from an adjacent network segment).
- Malicious input containing shell metacharacters is submitted and reaches
sub_2F77E8. - Injected commands execute with device-level privileges, giving the attacker a foothold on the device.
- The compromised device is used for lateral movement, traffic interception, or recruitment into an IoT botnet.
Mitigation
- No official Tenda patch has been referenced in the disclosure — check Tenda's support portal for firmware updates addressing CVE-2026-86151 and apply as soon as one is available.
- Do not expose device management interfaces directly to the internet. Place Tenda CP3 units behind a firewall or VPN and restrict management access to trusted internal networks.
- Segment IoT/camera devices onto a dedicated VLAN isolated from sensitive systems to limit blast radius if a device is compromised.
- Monitor outbound connections from camera/router devices for unexpected traffic patterns that could indicate compromise.
- Consider replacing end-of-support or infrequently-patched consumer IoT hardware in environments with elevated security requirements.