Overview
CVE-2026-86153 is a critical improper privilege management vulnerability in Tenda CP3 firmware 27.5.57.101, located in the CRedirServer::SetRedirectEnable function within Functions/Redirect.cpp. The flaw allows remote manipulation of the device's redirect/port-forwarding subsystem without proper authorization checks. It is the third of three related Tenda CP3 flaws disclosed together — see CVE-2026-86151 and CVE-2026-86152.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-86153 |
| CWE | CWE-269 (Improper Privilege Management) |
| Severity | Critical (CVSS 9.1) |
| Attack Vector | Network |
| Affected Function | CRedirServer::SetRedirectEnable in Functions/Redirect.cpp |
| Component | Redirect / port-forwarding service |
| Exploit Availability | No public PoC at time of writing |
How It Works
SetRedirectEnable governs whether port-forwarding/redirection rules are active on the device — functionality normally gated behind administrator authentication. The vulnerability stems from missing authorization checks on this method, meaning an attacker who can reach the router's management interface over the network can invoke the function directly and enable or reconfigure redirect rules without ever authenticating as an administrator.
Impact Assessment
Because port-forwarding rules control which internal services are exposed to the outside world, an attacker who can flip them on silently can:
- Expose internal devices (NVRs, NAS, cameras, IoT hubs) that were never meant to be internet-reachable
- Redirect legitimate traffic to attacker-controlled internal or external hosts
- Use the device as a pivot point into the LAN without needing valid credentials
- Make changes that persist and go unnoticed, since no admin login is required to trigger them
Combined with the command-injection flaws disclosed in the same firmware build (CVE-2026-86151, CVE-2026-86152), this gives attackers multiple independent, unauthenticated paths into affected devices.
Mitigation
- Watch for a Tenda firmware update addressing CVE-2026-86153; treat the device as unpatched until one is confirmed.
- Restrict management-interface access to trusted internal networks only — never expose it directly to the internet.
- Audit existing port-forwarding rules on any Tenda CP3 device for unexpected entries that may indicate prior exploitation.
- Segment the device onto an isolated VLAN so unauthorized redirect changes can't expose other internal systems.
- Consider disabling remote/UPnP-style redirect management entirely if it is not required for normal operation.