Description

A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be initiated remotely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-06T00:16:55.773Z",
  "pubdate": "2026-09-06T00:16:55.773Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in Tenda CP3 firmware version 27.5.57.101 within the Network Configuration Management component.\nThe vulnerability resides in the function sub_2F77E8 located in Apis/system.c. It allows a remote, unauthenticated attacker to execute arbitrary system commands with elevated privileges by injecting malicious input into the affected interface.\nSuccessful exploitation results in full device compromise, potentially allowing the attacker to gain persistent access, intercept network traffic, or manipulate device settings.\nThe risk is classified as high due to the potential for remote exploitation without requiring prior authentication, posing a significant threat to the confidentiality, integrity, and availability of the affected system.",
  "technicalDetails": "The vulnerability is an OS command injection flaw located within the sub_2F77E8 function of the Apis/system.c file. This function is responsible for processing network configuration management requests. The flaw occurs because the function fails to adequately sanitize or validate user-supplied input before passing it to system-level calls (e.g., system(), popen(), or equivalent wrappers).\nIn the context of the Tenda CP3 network configuration module, user inputs are typically passed through HTTP request parameters. If the input is directly concatenated into a string executed by the shell, an attacker can leverage command separators such as ';', '|', or '&&' to terminate the intended command and append arbitrary system commands.\nThe attack flow begins when an attacker sends a specially crafted remote request to the vulnerable Network Configuration Management endpoint. The request carries a payload designed to exploit the lack of input sanitization within the sub_2F77E8 function. When the firmware processes this request, the underlying shell interprets the injected metacharacters, executing the attacker's commands as the user running the process, which is typically the root user in embedded Linux environments common in SOHO routers.\nBecause the function sub_2F77E8 is part of the Network Configuration Management system, it is exposed to the network, allowing remote actors to trigger the execution without authentication. This vulnerability does not require physical access to the device.\nThe post-exploitation impact includes the ability to download and execute malicious binaries, modify firewall rules to bypass security controls, extract sensitive configuration files (including credentials or tokens), or incorporate the device into a botnet. Since the affected component executes with high-level privileges, the attacker gains full control over the underlying Linux OS of the Tenda CP3 device, effectively bypassing all intended security boundaries.\nThis vulnerability highlights a systemic failure in the input processing pipeline of the Apis/system.c component, specifically failing to adhere to secure coding practices such as using parameterized system calls or strict input allowlisting."
}