Description

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-05T22:17:18.743Z",
  "pubdate": "2026-09-05T22:17:18.743Z",
  "executiveSummary": "A critical OS command injection vulnerability exists within the Kylin component of Tenda CP3 firmware version 27.5.57.101.\nThe vulnerability resides in the 'SystemAsh' function located in 'Apis/system.c', specifically triggered by improper validation of the 'AlarmVoiceURL' parameter.\nBy manipulating this argument, an unauthenticated remote attacker can inject arbitrary operating system commands, which are subsequently executed with elevated system privileges.\nSuccessful exploitation results in full device compromise, potentially allowing the attacker to gain persistent access, exfiltrate sensitive data, or utilize the device as a node in a malicious botnet.\nGiven that the attack vector is remotely exploitable without requiring prior authentication, this flaw poses a severe risk to device integrity and user privacy.\nUsers are advised to restrict network access to the affected devices and monitor for firmware updates that address this command injection flaw.",
  "technicalDetails": "The vulnerability is an OS command injection flaw located in the Kylin component of the Tenda CP3 firmware version 27.5.57.101. The flaw is specifically situated within the 'SystemAsh' function inside the 'Apis/system.c' source file.\nThe root cause of the vulnerability is the improper sanitization and filtering of the 'AlarmVoiceURL' input argument. The application fails to adequately escape or validate user-supplied input before passing it into a system-level function call, such as 'system()', 'popen()', or a similar execution primitive.\nThe attack flow begins when an attacker sends a specially crafted, malicious HTTP request to the device's web management interface. This request targets the vulnerable endpoint associated with the 'SystemAsh' function, embedding arbitrary shell metacharacters (e.g., ';', '&', '|', or '$()') within the 'AlarmVoiceURL' parameter.\nUpon receiving the request, the 'SystemAsh' function processes the input string. Because the input is not treated as a literal URL but rather concatenated directly into a system command string, the underlying operating system interprets the injected metacharacters as command separators or operators. This results in the execution of the attacker's payload alongside, or in place of, the intended legitimate function.\nThe exploitation is categorized as remote, meaning no physical access to the Tenda CP3 device is required. Furthermore, the vulnerability does not require authentication, allowing any remote actor with network reachability to the device to trigger the injection.\nThe post-exploitation impact is critical. Since the command execution occurs within the context of the firmware's runtime environment, the attacker gains the ability to execute code with the same privileges as the web server process. This effectively grants the attacker control over the device, allowing them to modify system configurations, disable security controls, deploy backdoors, or pivot into the local network where the device is deployed. The lack of input validation serves as the primary technical failure, facilitating a direct path from an external HTTP parameter to arbitrary code execution on the underlying Linux-based operating system."
}