CVE-2026-19747: Tenda Smart Camera command injection in ATE Module

CVE-2026-19747 · Severity: critical · CVSS 9.8 · Published 2026-08-13

Tenda smart cameras contain a critical remote code execution vulnerability in the firmware's ATE (Automatic Test Equipment) diagnostic module. An unauthenticated attacker can send a specially crafted network packet to execute arbitrary system commands on the device, potentially leading to complete device compromise and lateral network attacks. This affects multiple camera models and is remotely exploitable without authentication.

Technologies: Tenda CH10, Tenda CH7, Tenda CH7G, Tenda CP3, Tenda CP3 Pro, Tenda CP7, Tenda TC3B14C, Tenda TC3B15C, Tenda TC3T14C, Tenda TC3T15C. Vendors: Tenda.

Quick answers

Is CVE-2026-19747 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19747 being exploited in the wild.
How severe is CVE-2026-19747?
Critical severity, with a CVSS score of 9.8, published 13 August 2026.
Which products and versions are affected?
Tenda CH10 up to V26.4.41.36; Tenda CH7 up to V26.5.59.2; Tenda CH7G up to V26.5.60.2; Tenda CP3 up to V27.5.57.17; and 6 more.
Is there a fix for CVE-2026-19747?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19747 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-19747?
Check whether you run Tenda CH10, Tenda CH7, Tenda CH7G or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unauthenticated command injection vulnerability exists in the CAte::HandleCmd function of the Kylin firmware binary used in Tenda smart cameras. The ATE Module processes incoming UDP packets on port 7320 without authentication or validation. User-controlled JSON fields are directly concatenated into system command strings via snprintf and executed through popen(), allowing attackers to inject shell metacharacters (semicolons, pipes, backticks) to alter command execution. The vulnerable code constructs commands like "rtwpriv wlan0 efuse_set [user_input]" without sanitization, and this pattern is replicated across multiple ATE command handlers (mp_phypara, mp_rate, iperf3, etc.). A remote, unauthenticated attacker with network access to port 7320 can achieve arbitrary code execution with device privileges.

Affected products

  • Tenda CH7 up to V26.5.59.2
  • Tenda CH7G up to V26.5.60.2
  • Tenda CH10 up to V26.4.41.36
  • Tenda CP3 up to V27.5.57.17
  • Tenda CP3 Pro up to V21.7.17.111
  • Tenda CP7 up to V26.5.45.17
  • Tenda TC3B14C up to V25.4.42.21
  • Tenda TC3B15C up to V25.4.26.53
  • Tenda TC3T14C up to V25.4.43.20
  • Tenda TC3T15C up to V25.4.43.21

Timeline

  • 2026-08-13: disclosed: Vulnerability disclosed on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.