Executive brief
Tenda smart cameras contain a critical remote code execution vulnerability in the firmware's ATE (Automatic Test Equipment) diagnostic module. An unauthenticated attacker can send a specially crafted network packet to execute arbitrary system commands on the device, potentially leading to complete device compromise and lateral network attacks. This affects multiple camera models and is remotely exploitable without authentication.
Technical details
An unauthenticated command injection vulnerability exists in the CAte::HandleCmd function of the Kylin firmware binary used in Tenda smart cameras. The ATE Module processes incoming UDP packets on port 7320 without authentication or validation. User-controlled JSON fields are directly concatenated into system command strings via snprintf and executed through popen(), allowing attackers to inject shell metacharacters (semicolons, pipes, backticks) to alter command execution. The vulnerable code constructs commands like "rtwpriv wlan0 efuse_set [user_input]" without sanitization, and this pattern is replicated across multiple ATE command handlers (mp_phypara, mp_rate, iperf3, etc.). A remote, unauthenticated attacker with network access to port 7320 can achieve arbitrary code execution with device privileges.
Affected products
- Tenda CH7 up to V26.5.59.2
- Tenda CH7G up to V26.5.60.2
- Tenda CH10 up to V26.4.41.36
- Tenda CP3 up to V27.5.57.17
- Tenda CP3 Pro up to V21.7.17.111
- Tenda CP7 up to V26.5.45.17
- Tenda TC3B14C up to V25.4.42.21
- Tenda TC3B15C up to V25.4.26.53
- Tenda TC3T14C up to V25.4.43.20
- Tenda TC3T15C up to V25.4.43.21
Timeline
- 2026-08-13: disclosed: Vulnerability disclosed on NVD