Description

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched remotely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-06T02:17:19.370Z",
  "pubdate": "2026-09-06T02:17:19.370Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in the Tenda CP3 firmware version 27.5.57.101.\nThe vulnerability resides within the 'Kylin' component, specifically impacting the 'CAutoAddWifi::ThreadProc' function located in 'Functions/AutoAddWifi.cpp'.\nThis security flaw allows a remote, unauthenticated attacker to execute arbitrary system commands on the underlying operating system of the affected device.\nThe attack vector involves manipulating inputs processed by the targeted thread, which are then passed to a system shell without adequate sanitization.\nSuccessful exploitation results in full remote code execution, granting the attacker unauthorized control over the device. This poses a severe risk to network integrity, data confidentiality, and system availability.\nGiven the nature of the vulnerability, an attacker can leverage this access to establish persistence, pivot within the internal network, or participate in botnet activities.\nImmediate remediation is necessary to prevent potential exploitation.",
  "technicalDetails": "The vulnerability is an OS command injection flaw located within the 'CAutoAddWifi::ThreadProc' function in the 'Functions/AutoAddWifi.cpp' file of the Tenda CP3 firmware version 27.5.57.101.\nThe root cause of this vulnerability is improper neutralization of special elements used in an OS command. The 'Kylin' component performs operations that involve constructing shell commands based on user-supplied or network-derived inputs that are not validated or escaped before execution.\nThe 'CAutoAddWifi::ThreadProc' function, which handles automated Wi-Fi configuration tasks, processes these inputs in a multi-threaded execution context. When a specifically crafted input is provided to the affected interface, the application fails to distinguish between legitimate configuration parameters and malicious shell metacharacters.\nThe attack flow begins with the attacker sending a specially crafted request to the Tenda CP3 device. Since the 'Kylin' component processes this request within the 'ThreadProc' context, the malicious payload is incorporated into a command string that is passed directly to the system's execution shell, such as 'system()' or 'popen()'.\nBecause the input is not sanitized, the shell interprets the injected metacharacters (e.g., semicolon, backticks, or pipe operators) as command separators, allowing the attacker to chain additional commands. This leads to the arbitrary execution of code with the privileges of the process running the 'Kylin' component, which typically operates with elevated root permissions on embedded firmware.\nThis vulnerability is reachable remotely over the network, as the component is exposed to handle incoming Wi-Fi association or management requests. Authentication is not explicitly required to trigger this path, as the processing logic resides in an early stage of the Wi-Fi auto-configuration routine. The resulting post-exploitation impact includes full system compromise, the ability to modify system configurations, potential data exfiltration, and the capability to use the device as a node in further malicious activities."
}