CVE-2026-86148: Tenda CP3 Kylin system.c SystemAsh os command injection
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The provided vector indicates high privileges are required (PR:H). The attack can be launched remotely and does not require user interaction.
Which input should defenders focus on when assessing exposure?
The affected input is the AlarmVoiceURL argument processed by the SystemAsh function in Apis/system.c. Manipulation of this argument can result in operating-system command injection.
What impact could successful exploitation have?
The supplied severity vector indicates impacts across confidentiality, integrity, and availability are all high. It also indicates scope can change (S:C).
How certain is the reported vulnerability status?
The vector marks report confidence as reasonable (RC:R). The record identifies Tenda CP3 version 27.5.57.101, but does not provide information about fixed versions, affected version ranges, or mitigations.