CVE-2026-86149: Tenda CP3 NetCheckPing.cpp os command injection
Published Sep 5, 2026
·Updated
A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interfacename/host causes os command injection. The attack can be initiated remotely.
Affected Software
1 affected component
Tenda CP3=27.5.57.101
Event History
Sep 5, 2026
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The listed vector indicates that an attacker needs high privileges, but can exploit the issue remotely without user interaction. The attack complexity is rated low.
2
What is the potential impact if exploitation succeeds?
The vulnerability is rated critical with a 9.1 severity score. Its vector indicates high impact to confidentiality, integrity, and availability, with scope changed.
3
Which input appears to be vulnerable?
The affected processing is in Net/NetCheckPing.cpp and involves the interface_name/host argument. Manipulating that argument can lead to OS command injection.