CVE-2026-19747: Tenda CH7 ATE Module Kylin HandleCmd command injection
A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19747?
CVE-2026-19747 has a critical severity rating of 9.8.
How does CVE-2026-19747 affect Tenda devices?
CVE-2026-19747 impacts the HandleCmd function in the Kylin component of various Tenda device models, allowing for command injection.
Which Tenda devices are vulnerable to CVE-2026-19747?
Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, and TC3B15C devices up to version 20260625 are vulnerable.
How can I mitigate CVE-2026-19747?
To mitigate CVE-2026-19747, it is recommended to update the firmware of vulnerable Tenda devices to the latest version.
What type of vulnerability is CVE-2026-19747 categorized as?
CVE-2026-19747 is categorized as a command injection vulnerability.